diff --git a/.github/workflows/bot-bot.yml b/.github/workflows/bot-bot.yml
index a8b11d110..3d35fb116 100644
--- a/.github/workflows/bot-bot.yml
+++ b/.github/workflows/bot-bot.yml
@@ -54,6 +54,7 @@ jobs:
           MEMORY_LIMIT_GB: 7
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: status of changes
         if: github.ref == 'refs/heads/master' && always() && ! env.CI_SKIP
diff --git a/.github/workflows/bot-cache.yml b/.github/workflows/bot-cache.yml
index 6a7aca04a..d4143f2a6 100644
--- a/.github/workflows/bot-cache.yml
+++ b/.github/workflows/bot-cache.yml
@@ -62,6 +62,7 @@ jobs:
         env:
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
+          CF_TICK_CONTAINER_TAG: latest
 
   bot-cache-trigger:
     needs: bot-cache
diff --git a/.github/workflows/bot-feedstocks.yml b/.github/workflows/bot-feedstocks.yml
index df2e8e419..611649d8d 100644
--- a/.github/workflows/bot-feedstocks.yml
+++ b/.github/workflows/bot-feedstocks.yml
@@ -15,8 +15,18 @@ jobs:
         shell: bash -leo pipefail {0}
 
     steps:
+      - name: get latest release
+        id: latest_release
+        run: |
+          tag_name=$(gh api repos/regro/cf-scripts/releases/latest --jq '.tag_name')
+          echo "latest release: ${tag_name}"
+          echo "tag_name=${tag_name}" >> "$GITHUB_OUTPUT"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
         with:
+          ref: ${{ steps.latest_release.outputs.tag_name }}
           path: cf-scripts
 
       - uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822 # v1
diff --git a/.github/workflows/bot-make-graph.yml b/.github/workflows/bot-make-graph.yml
index f95d147a9..f23f7016c 100644
--- a/.github/workflows/bot-make-graph.yml
+++ b/.github/workflows/bot-make-graph.yml
@@ -51,6 +51,7 @@ jobs:
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
           BOT_JOB: ${{ matrix.job_num }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && always() && ! env.CI_SKIP
@@ -113,6 +114,7 @@ jobs:
         env:
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && always() && ! env.CI_SKIP
diff --git a/.github/workflows/bot-make-migrators.yml b/.github/workflows/bot-make-migrators.yml
index 87b4e2140..060bb7921 100644
--- a/.github/workflows/bot-make-migrators.yml
+++ b/.github/workflows/bot-make-migrators.yml
@@ -47,6 +47,7 @@ jobs:
         env:
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && always() && ! env.CI_SKIP
diff --git a/.github/workflows/bot-prs.yml b/.github/workflows/bot-prs.yml
index 65cee0579..fae76bcbc 100644
--- a/.github/workflows/bot-prs.yml
+++ b/.github/workflows/bot-prs.yml
@@ -54,6 +54,7 @@ jobs:
           BOT_JOB: ${{ matrix.job_num }}
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && ! cancelled() && ! env.CI_SKIP
diff --git a/.github/workflows/bot-pypi-mapping.yml b/.github/workflows/bot-pypi-mapping.yml
index b9ce6d694..69f8e0ea8 100644
--- a/.github/workflows/bot-pypi-mapping.yml
+++ b/.github/workflows/bot-pypi-mapping.yml
@@ -45,6 +45,7 @@ jobs:
           conda-forge-tick make-import-to-package-mapping
         env:
           BOT_TOKEN: ${{ secrets.AUTOTICK_BOT_TOKEN }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: build pypi mapping
         if: success() && ! env.CI_SKIP
@@ -54,6 +55,7 @@ jobs:
           conda-forge-tick make-mappings
         env:
           BOT_TOKEN: ${{ secrets.AUTOTICK_BOT_TOKEN }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && ! cancelled() && ! env.CI_SKIP
diff --git a/.github/workflows/bot-update-status-page.yml b/.github/workflows/bot-update-status-page.yml
index e8f7cdf3c..0bf5e03b8 100644
--- a/.github/workflows/bot-update-status-page.yml
+++ b/.github/workflows/bot-update-status-page.yml
@@ -43,6 +43,7 @@ jobs:
           conda-forge-tick make-status-report
         env:
           BOT_TOKEN: ${{ secrets.AUTOTICK_BOT_TOKEN }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && ! cancelled() && ! env.CI_SKIP
diff --git a/.github/workflows/bot-versions.yml b/.github/workflows/bot-versions.yml
index 32c4b2cda..9f186b77d 100644
--- a/.github/workflows/bot-versions.yml
+++ b/.github/workflows/bot-versions.yml
@@ -51,6 +51,7 @@ jobs:
           BOT_JOB: ${{ matrix.job_num }}
           CF_TICK_GRAPH_DATA_BACKENDS: "${{ vars.CF_TICK_GRAPH_DATA_BACKENDS }}"
           MONGODB_CONNECTION_STRING: ${{ secrets.MONGODB_CONNECTION_STRING }}
+          CF_TICK_CONTAINER_TAG: latest
 
       - name: deploy
         if: github.ref == 'refs/heads/master' && ! cancelled() && ! env.CI_SKIP
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 62c165774..a83561c54 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -34,8 +34,6 @@ jobs:
 
       - name: configure conda and install code
         run: |
-          export GIT_FULL_HASH=`git rev-parse HEAD`
-          export RUN_URL=""
           pip install --no-deps --no-build-isolation -e .
 
       - name: test versions
@@ -86,6 +84,7 @@ jobs:
             tests
         env:
           MONGODB_CONNECTION_STRING: "mongodb://127.0.0.1:27017/?directConnection=true&serverSelectionTimeoutMS=2000"
+          RUN_URL: ""
 
       - name: upload codecov
         uses: codecov/codecov-action@e28ff129e5465c2c0dcc6f003fc735cb6ae0c673 # v4
diff --git a/README.md b/README.md
index b31be2e4b..19521dc62 100644
--- a/README.md
+++ b/README.md
@@ -228,6 +228,7 @@ If your migrator needs special configuration, you should write a new factory fun
 - `RUN_URL`: set to the URL of the CI build (now set to a GHA run URL)
 - `MEMORY_LIMIT_GB`: set to the memory limit in GB for the bot
 - `BOT_TOKEN`: a GitHub token for the bot user
+- `CF_TICK_CONTAINER_TAG`: set this to override the default container tag used in production runs, otherwise the value of `__version__` is used
 
 ### Running Tests
 
@@ -356,11 +357,11 @@ This is an important number to know when proposing a migration
 ### `conda-forge-tick` Container Image and Dockerfile
 
 The bot relies on a container image to run certain tasks. The image is built from the `Dockerfile` in the root of
-this repository and hosted via `ghcr.io`. The `latest` tag is used for production jobs and updated automatically
+this repository and hosted via `ghcr.io`. The `__version__` tag is used for production jobs and updated automatically
 when PRs are merged. The container is typically run via
 
 ```bash
-docker run --rm -t conda-forge-tick:latest python /opt/autotick-bot/docker/run_bot_task.py <task> <args>
+docker run --rm -t conda-forge-tick:<__version__> python /opt/autotick-bot/docker/run_bot_task.py <task> <args>
 ```
 
 See the [run_bot_task.py](docker/run_bot_task.py) script for more information.
diff --git a/autotick-bot/install_bot_code.sh b/autotick-bot/install_bot_code.sh
index 36fe0cbb6..775ca1d65 100644
--- a/autotick-bot/install_bot_code.sh
+++ b/autotick-bot/install_bot_code.sh
@@ -22,8 +22,6 @@ sudo apt-get autoclean -y >& /dev/null
 sudo docker image prune --all --force
 df -h
 
-docker pull ghcr.io/regro/conda-forge-tick:latest
-
 git config --global user.name regro-cf-autotick-bot
 git config --global user.email 36490558+regro-cf-autotick-bot@users.noreply.github.com
 git config --global pull.rebase false
@@ -32,7 +30,6 @@ conda update conda-forge-pinning --yes
 
 cd cf-scripts
 
-export GIT_FULL_HASH=$(git rev-parse HEAD)
 pip install --no-deps --no-build-isolation -e .
 
 cd ..
@@ -44,6 +41,8 @@ else
     echo "Skipping cloning of cf-graph and pinning feedstock"
 fi
 
+docker pull ghcr.io/regro/conda-forge-tick:$(python -c "import conda_forge_tick; print(conda_forge_tick.__version__)")
+
 echo -e "\n\n============================================\n============================================"
 conda info
 conda config --show-sources
diff --git a/conda_forge_tick/utils.py b/conda_forge_tick/utils.py
index a94e0063c..678b7806f 100644
--- a/conda_forge_tick/utils.py
+++ b/conda_forge_tick/utils.py
@@ -22,6 +22,7 @@
 import ruamel.yaml
 
 from . import sensitive_env
+from ._version import __version__
 from .lazy_json_backends import LazyJson
 
 if typing.TYPE_CHECKING:
@@ -122,7 +123,9 @@ def get_default_container_name():
     if os.environ.get("CF_TICK_PYTEST", "false") == "true":
         cname = "conda-forge-tick:test"
     else:
-        cname = "ghcr.io/regro/conda-forge-tick:latest"
+        cname = "ghcr.io/regro/conda-forge-tick:" + os.environ.get(
+            "CF_TICK_CONTAINER_TAG", __version__
+        )
 
     return cname