diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f9907c0..7556ee9d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,7 +13,6 @@ concurrency:
 
 env:
   REGISTRY: ghcr.io
-  LATEST_TAG: ghcr.io/agoric/agoric-3-proposals:latest
 
 jobs:
   # see https://docs.docker.com/build/ci/github-actions/test-before-push/
@@ -35,11 +34,14 @@ jobs:
           echo "=== After cleanup:"
           df -h
       - uses: actions/checkout@v4
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: agoric/agoric-3-proposals
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
-      - name: Login to Docker Registry
+      - name: Login to GHCR
         uses: docker/login-action@v3
         # see https://docs.github.com/en/actions/publishing-packages/publishing-docker-images
         with:
@@ -52,13 +54,20 @@ jobs:
         run: ./buildTestImages.ts
       - name: run test images
         run: ./runTestImages.ts
-      # this should be fast because all the stages were already built
+      # ??? does it push correctly? https://github.com/Agoric/agoric-3-proposals/actions/runs/6750864452/job/18353986038?pr=11
+      # FIXME this is starting the build from scratch
+      # but this should be fast because all the stages were already built in the steps above
       - name: Build and push complete image
         uses: docker/build-push-action@v5
         with:
           context: .
+          # Output to local Docker client to re-use the stages in the previous build step
+          load: true
+          # push to registry on every repo push. A PR #2 will push with tag `pr-2` and `main` will have tag `main`.
+          # See https://github.com/docker/metadata-action?tab=readme-ov-file#basic.
           push: true
-          tags: ${{ env.LATEST_TAG }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
       - name: notify on failure
         if: failure() && github.event_name != 'pull_request'
         uses: ./.github/actions/notify-status