diff --git a/.github/workflows/release-cloud-prod.yml b/.github/workflows/release-cloud-prod.yml
index bc6f68a2d..d9fa0f777 100644
--- a/.github/workflows/release-cloud-prod.yml
+++ b/.github/workflows/release-cloud-prod.yml
@@ -14,7 +14,23 @@ concurrency:
   cancel-in-progress: false
 
 jobs:
+  # The image tags below are only enabled for `v*` tag refs. Fail fast with a
+  # clear error when dispatched from a branch rather than letting buildx fail
+  # with "tag is needed when pushing to registry".
+  validate-ref:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require a release tag ref
+        env:
+          REF: ${{ github.ref }}
+        run: |
+          if [[ "$REF" != refs/tags/v* ]]; then
+            echo "::error::Cloud production releases must run against a release tag (got '$REF'). Re-run with: gh workflow run release-cloud-prod.yml --ref v<version>"
+            exit 1
+          fi
+
   build:
+    needs: validate-ref
     uses: ./.github/workflows/_build-cloud.yml
     with:
       environment: prod
diff --git a/.github/workflows/release-prod.yml b/.github/workflows/release-prod.yml
index 72c7a5c37..98d7b0479 100644
--- a/.github/workflows/release-prod.yml
+++ b/.github/workflows/release-prod.yml
@@ -145,7 +145,7 @@ jobs:
       - name: Commit changes
         run: |
           git add CHANGELOG.md packages/shared/src/version.ts docs/api-reference/sourcebot-public.openapi.json
-          git commit -m "[skip ci] Release v$VERSION"
+          git commit -m "Release v$VERSION"
 
       - name: Push to temporary branch
         id: push_temp_branch