diff --git a/.github/workflows/docker-image.yaml b/.github/workflows/docker-image.yaml
index ad3a3d300..2c6c9ad8a 100644
--- a/.github/workflows/docker-image.yaml
+++ b/.github/workflows/docker-image.yaml
@@ -9,6 +9,10 @@ name: "GHCR: Command-Line Container"
 on:
   push:
     branches: [main, development]
+    # release.yml creates the Release with GITHUB_TOKEN, which raises no
+    # workflow events, so `release:` below never fires. This is the path
+    # that produces a version-tagged image.
+    tags: ['v*']
     paths:
       # Only rebuild when these files change
       - 'container/Containerfile'
diff --git a/.github/workflows/hpc-uw3-image.yml b/.github/workflows/hpc-uw3-image.yml
index fbac9eef0..9f9116329 100644
--- a/.github/workflows/hpc-uw3-image.yml
+++ b/.github/workflows/hpc-uw3-image.yml
@@ -21,9 +21,9 @@ on:
       - 'pyproject.toml'
       - 'setup.py'
       - 'src/**'
-  # Releases are the guaranteed path for a tagged image: the `tags:` filter above
-  # is combined with `paths:`, so a tag whose diff touches nothing in that list
-  # would not build on its own.
+  # Never fires in practice: release.yml creates the Release with
+  # GITHUB_TOKEN, which raises no workflow events. The `tags:` filter
+  # above is what builds the tagged image. Kept for a hand-published Release.
   release:
     types: [published]
   workflow_dispatch: