diff --git a/.github/workflows/prebuilt.yaml b/.github/workflows/prebuilt.yaml
index 1fd093e2ac..6acc7a2e9c 100644
--- a/.github/workflows/prebuilt.yaml
+++ b/.github/workflows/prebuilt.yaml
@@ -21,6 +21,7 @@ jobs:
       IMAGE_NAME: openpilot-prebuilt
     steps:
     - name: Wait for green check mark
+      if: ${{ github.event_name != 'workflow_dispatch' }}
       uses: lewagon/wait-on-check-action@e2558238c09778af25867eb5de5a3ce4bbae3dcd
       with:
         ref: master
@@ -38,3 +39,5 @@ jobs:
       run: |
         $DOCKER_LOGIN
         docker push $DOCKER_REGISTRY/$IMAGE_NAME:latest
+        docker tag $DOCKER_REGISTRY/$IMAGE_NAME:latest $DOCKER_REGISTRY/$IMAGE_NAME:$GITHUB_SHA
+        docker push $DOCKER_REGISTRY/$IMAGE_NAME:$GITHUB_SHA
diff --git a/.github/workflows/selfdrive_tests.yaml b/.github/workflows/selfdrive_tests.yaml
index fc389fd280..5fecdc5b51 100644
--- a/.github/workflows/selfdrive_tests.yaml
+++ b/.github/workflows/selfdrive_tests.yaml
@@ -167,7 +167,6 @@ jobs:
     name: docker push
     runs-on: ubuntu-20.04
     if: github.ref == 'refs/heads/master' && github.event_name != 'pull_request' && github.repository == 'commaai/openpilot'
-    needs: static_analysis # hack to ensure slow tests run first since this and static_analysis are fast
     steps:
     - uses: actions/checkout@v3
       with:
@@ -178,12 +177,16 @@ jobs:
       run: |
         $DOCKER_LOGIN
         docker push $DOCKER_REGISTRY/$BASE_IMAGE:latest
+        docker tag $DOCKER_REGISTRY/$BASE_IMAGE:latest $DOCKER_REGISTRY/$BASE_IMAGE:$GITHUB_SHA
+        docker push $DOCKER_REGISTRY/$BASE_IMAGE:$GITHUB_SHA
     - name: Build CL Docker image
       run: eval "$BUILD_CL"
     - name: Push to container registry
       run: |
         $DOCKER_LOGIN
         docker push $DOCKER_REGISTRY/$CL_BASE_IMAGE:latest
+        docker tag $DOCKER_REGISTRY/$CL_BASE_IMAGE:latest $DOCKER_REGISTRY/$CL_BASE_IMAGE:$GITHUB_SHA
+        docker push $DOCKER_REGISTRY/$CL_BASE_IMAGE:$GITHUB_SHA
 
   static_analysis:
     name: static analysis