diff --git a/dd-ctl b/dd-ctl
index 6c38630..9a74227 100755
--- a/dd-ctl
+++ b/dd-ctl
@@ -174,6 +174,10 @@ ddupdate(){
 }
 
 build_compose(){
+	DD_DEFAULT_BUILD="$(git rev-parse --short HEAD)"
+	export DD_BUILD="${DD_BUILD:-${DD_DEFAULT_BUILD}}"
+	setconf DD_BUILD "${DD_BUILD}" .env
+
 	setconf CUSTOM_PATH "$CUSTOM_PATH" .env
 	setconf BUILD_APPS_ROOT_PATH "$CUSTOM_PATH/dd-apps" .env
 	setconf BUILD_SSO_ROOT_PATH "$CUSTOM_PATH/dd-sso" .env
@@ -755,6 +759,40 @@ setconf() {
 	fi
 }
 
+special_image_tags() {
+	# Special image tags that apply to this build
+	head="$(git rev-parse HEAD)"
+	# loop through BRANCH:TAG1[:TAG2:...:TAG_N] items
+	for tag_info in develop:latest main:stable; do
+		branch="$(echo "${tag_info}" | cut -d ':' -f 1)"
+		upstream="$(git rev-parse "${DD_REMOTE:-origin}/${branch}" 2>/dev/null || true)"
+		if [ "${head}" = "${upstream}" ]; then
+			# If head and upstream match, use these tags
+			special_tags="$(echo "${tag_info}" | cut -d ':' -f 2- | tr ':' ' ')"
+			echo "${special_tags}"
+		fi
+	done
+}
+
+push_images() {
+	#
+	# Note this requires docker login on the registry
+	# (Runs on CI)
+	#
+	# Get images that are using the registry
+	images="$(docker ps --format '{{ .Names }}\t{{ .Image }}' | grep "${DD_REGISTRY:-registry.dd-work.space}")"
+	for extra_tag in $(special_image_tags); do
+		# And apply the special tags on them
+		for image in $(echo "${images}" | cut -f 2); do
+			docker tag "${image}" "${image%:*}:${extra_tag}"
+		done
+	done
+	image_names="$(echo "${images}" | cut -f 1 | tr '\n' '\t')"
+	# Finally, actually push all tags to the registry
+	# shellcheck disable=SC2086  # We do want multiple arguments
+	docker-compose push ${image_names:?}
+}
+
 # Argument handling
 case "$OPERATION" in
 	build)
@@ -876,6 +914,9 @@ case "$OPERATION" in
 	listpatches)
 		listpatches
 	;;
+	push-images)
+		push_images
+	;;
 	failing-containers)
 		fc="$(docker ps --format '{{.Names}}' -f 'health=unhealthy')"
 		if [ -n "${fc}" ]; then
diff --git a/dd-sso/docker-compose-parts/admin.yml b/dd-sso/docker-compose-parts/admin.yml
index 15f851f..4dd8489 100644
--- a/dd-sso/docker-compose-parts/admin.yml
+++ b/dd-sso/docker-compose-parts/admin.yml
@@ -21,6 +21,7 @@ version: '3.7'
 services:
   dd-sso-admin:
     container_name: dd-sso-admin
+    image: registry.dd-work.space/dd/sso-admin:${DD_BUILD:-latest}
     build:
       context: ${BUILD_SSO_ROOT_PATH}
       dockerfile: admin/docker/Dockerfile