diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
index 255ea2c27..a2c67a1e9 100644
--- a/.github/workflows/publish-image.yml
+++ b/.github/workflows/publish-image.yml
@@ -160,9 +160,11 @@ jobs:
 
       - name: Create multi-arch manifests
         shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
           echo "Creating manifests for tags:"
           printf '%s\n' "$tags"
           while IFS= read -r tag; do
@@ -192,9 +194,11 @@ jobs:
 
       - name: Cosign sign all tags (keyless OIDC)
         shell: bash
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           set -eu
-          tags="${{ steps.meta.outputs.tags }}"
+          tags="$TAGS"
           printf '%s\n' "$tags"
           while IFS= read -r tag; do
             [ -z "$tag" ] && continue