diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 12c679b..7a60a5b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -83,9 +83,10 @@ jobs:
           mkdir -p ~/.kube
           sops decrypt ./helmfile/secrets/kubeconfig > ~/.kube/config
           chmod 600 ~/.kube/config
-      - run: echo "IMAGE_TAG=ocelot-${{ inputs.ocelot_version }}--branded-sha-$(echo $GITHUB_SHA | cut -c 1-7)" >> $GITHUB_ENV
       - uses: helmfile/helmfile-action@80fbb6408b98822310f94d8d1321a2cacf87f78f #v1.9.2
         with:
+          env:
+            OCELOT_IMAGE_TAG: ${{ inputs.ocelot_version }}
           helmfile-args: apply
           helmfile-workdirectory: ./helmfile
           helm-plugins: >
diff --git a/helmfile/environments/default.yaml.gotmpl b/helmfile/environments/default.yaml.gotmpl
index cc64193..35beae5 100644
--- a/helmfile/environments/default.yaml.gotmpl
+++ b/helmfile/environments/default.yaml.gotmpl
@@ -1,3 +1,6 @@
+{{ $branded_image_tag:= env "BRANDED_IMAGE_TAG" | default (exec "../scripts/image_tag.sh" (list) | trim) }}
+{{ $ocelot_image_tag := env "OCELOT_IMAGE_TAG" | default "master" }}
+
 domain: staging.ocelot-social.roschaefer.de
 namespace: ocelot-staging
-image_tag: {{ requiredEnv "IMAGE_TAG" }}
+image_tag: {{ env "IMAGE_TAG" | default (printf "ocelot-%s--branded-%s" $ocelot_image_tag $branded_image_tag) }}
diff --git a/helmfile/scripts/image_tag.sh b/helmfile/scripts/image_tag.sh
new file mode 100755
index 0000000..f921945
--- /dev/null
+++ b/helmfile/scripts/image_tag.sh
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+echo "sha-$(git rev-parse HEAD | cut -c 1-7)"