diff --git a/.gitea/workflows/build-cuda-image.yml b/.gitea/workflows/build-cuda-image.yml
index b81a9873..20df9347 100644
--- a/.gitea/workflows/build-cuda-image.yml
+++ b/.gitea/workflows/build-cuda-image.yml
@@ -46,9 +46,15 @@ jobs:
         run: |
           LS_VER="${{ inputs.llama_swap_version || 'v230' }}"
           LCPP="${{ inputs.llamacpp_build || 'b9821' }}"
+          SHORT_SHA="$(echo '${{ github.sha }}' | cut -c1-7)"
+          IMAGE="${REGISTRY}/${{ github.repository }}"
+          # Three tags per build: the version label (mutable, human-facing),
+          # an explicit moving main-cuda tag, and an immutable sha tag so a
+          # deployment can always pin the exact build.
           {
-            echo "image=${REGISTRY}/${{ github.repository }}"
+            echo "image=${IMAGE}"
             echo "tag=${LS_VER}-cuda-${LCPP}"
+            echo "tags=${IMAGE}:${LS_VER}-cuda-${LCPP},${IMAGE}:main-cuda-${LCPP},${IMAGE}:sha-${SHORT_SHA}"
             echo "base_tag=server-cuda-${LCPP}"
             echo "ls_version=${LS_VER}"
             echo "build_date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
@@ -76,8 +82,8 @@ jobs:
             LS_VERSION=${{ steps.meta.outputs.ls_version }}
             GIT_HASH=${{ github.sha }}
             BUILD_DATE=${{ steps.meta.outputs.build_date }}
-          tags: ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}
+          tags: ${{ steps.meta.outputs.tags }}
 
       - name: Summary
         run: |
-          echo "Pushed ${{ steps.meta.outputs.image }}:${{ steps.meta.outputs.tag }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "Pushed ${{ steps.meta.outputs.tags }}" >> "$GITHUB_STEP_SUMMARY"