diff --git a/.buildkite/release.yaml b/.buildkite/release.yaml
index d38721dd2..e913feb68 100644
--- a/.buildkite/release.yaml
+++ b/.buildkite/release.yaml
@@ -23,14 +23,14 @@ steps:
     label: ":ship: Push all images (x86_64)"
     if: build.branch == "master" && build.tag == null
     commands:
-      - make ARCH=x86_64 push-all-images
+      - make ARCH=x86_64 DOCKER_PUSH_AS_LATEST=true push-all-images
     agents:
       arch: "amd64"
   - <<: *common
     label: ":ship: Push all images (aarch64)"
     if: build.branch == "master" && build.tag == null
     commands:
-      - make ARCH=aarch64 push-all-images
+      - make ARCH=aarch64 DOCKER_PUSH_AS_LATEST=true push-all-images
     agents:
       arch: "arm64"
   - <<: *common
diff --git a/tools/images.mk b/tools/images.mk
index 4a1dd1656..6607b4ab4 100644
--- a/tools/images.mk
+++ b/tools/images.mk
@@ -128,7 +128,7 @@ $(foreach image, $(ALL_IMAGES), $(eval $(call tag_expand_rule,$(image))))
 local_tag = \
   docker tag $(call remote_image,$(1)):$(call tag,$(1)) $(call local_image,$(1)):$(call tag,$(1)) >&2
 latest_tag = \
-  docker tag $(call local_image,$(1)):$(call tag,$(1)) $(call local_image,$(1)) >&2
+  docker tag $(call local_image,$(1)):$(call tag,$(1)) $(call local_image,$(1)):latest >&2
 tag-%: ## Tag a local image.
 	@$(call header,TAG $*)
 	@$(call local_tag,$*) && $(call latest_tag,$*)
@@ -181,9 +181,17 @@ test-%: register-cross ## Build an image locally if the remote doesn't exist.
 # push pushes the remote image, after validating that the tag doesn't exist
 # yet. Note that this generic rule will match the fully-expanded remote image
 # tag.
+# If DOCKER_PUSH_AS_LATEST is set to true, this also marks this image as being
+# the latest one on the remote repository.
+DOCKER_PUSH_AS_LATEST ?= false
 push-%:
 	$(call image_manifest,$*) >&2 || \
-	( $(call rebuild,$*) && docker image push $(call remote_image,$*):$(call tag,$*) >&2 )
+	( $(call rebuild,$*) && \
+	  docker image push $(call remote_image,$*):$(call tag,$*) >&2 && \
+	  ( test $(DOCKER_PUSH_AS_LATEST) '!=' true || \
+	    docker image push $(call remote_image,$*):latest >&2 \
+	  ) \
+	)
 
 # register-cross registers the necessary qemu binaries for cross-compilation.
 # This may be used by any target that may execute containers that are not the