diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0903958..43ac49f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -115,13 +115,14 @@ jobs:
       - name: Inspect manifest
         env:
           IMAGE: ${{ env.IMAGE }}
-          REF: ${{ github.ref }}
-          SHA: ${{ github.sha }}
         run: |
-          if [[ "$REF" == refs/tags/v* ]]; then
-            tag="${REF#refs/tags/}"
-          else
-            tag="nightly-$SHA"
-          fi
+          # Pull the first tag actually pushed by docker/metadata-action in the previous
+          # step (env var DOCKER_METADATA_OUTPUT_JSON). The legacy logic re-derived from
+          # ${{ github.ref }} / ${{ github.sha }}, but `type=sha,prefix=nightly-` writes
+          # the short 7-char SHA while `${{ github.sha }}` is the full 40-char hash, so
+          # the inspect always 404'd on main pushes (e.g. searched for
+          # nightly-2b146e36bd89510b0027978d72fdcb2a95b5bb37 but only
+          # nightly-2b146e3 was pushed).
+          tag=$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")
           docker buildx imagetools inspect "$IMAGE:$tag"