diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 49c5e82..88376d3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,13 +3,38 @@ name: Build
 on:
   push:
     branches: [ "main" ]
+    # Release tags, as created by tag-release.sh. The tag run deploys the release
+    # jars and publishes the versioned docker image (see determine-version).
+    tags: [ '[0-9]+.[0-9]+.[0-9]+*' ]
   pull_request:
     branches: [ "main" ]
   # Manual runs: on main this publishes orbitalhq/nebula:next, same as a push build
   workflow_dispatch:
 
 jobs:
+  # tag-release.sh pushes the release commit to main and then pushes the tag, which
+  # would build and deploy the same release twice. A branch run whose pom carries a
+  # release (non-SNAPSHOT) version is skipped here and left to the tag run.
+  gate:
+    runs-on: ubuntu-latest
+    outputs:
+      build: ${{ steps.decide.outputs.build }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Decide whether this run should build
+        id: decide
+        run: |
+          version=$(sed -n 's:.*<version>\(.*\)</version>.*:\1:p' pom.xml | head -1)
+          if [ "${{ github.ref_type }}" != "tag" ] && [[ "$version" != *-SNAPSHOT ]]; then
+            echo "Release version ${version} on a branch run: skipping, the tag run publishes it"
+            echo "build=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "build=true" >> "$GITHUB_OUTPUT"
+          fi
+
   build-jvm:
+    needs: gate
+    if: needs.gate.outputs.build == 'true'
     runs-on: ubuntu-latest
 
     steps: