diff --git a/.github/workflows/image-push-manual.yml b/.github/workflows/image-push-manual.yml
index fcf6adf6e..4bf35ca43 100644
--- a/.github/workflows/image-push-manual.yml
+++ b/.github/workflows/image-push-manual.yml
@@ -121,6 +121,7 @@ jobs:
         env:
           SVC_PATH: ${{ github.event.inputs.service_path }}
           TAG: ${{ steps.meta.outputs.tag }}
+          NVCF_VERSION: ${{ steps.meta.outputs.tag }}
           REGISTRY: ${{ secrets.NCP_DEV_REGISTRY }}
         run: |
           set -euo pipefail
@@ -145,7 +146,7 @@ jobs:
             mkdir -p ci-ghcr
             printf 'load("@rules_oci//oci:defs.bzl", "oci_push")\n\noci_push(\n    name = "push",\n    image = "%s",\n    repository = "%s",\n    remote_tags = ["%s", "latest-dispatch"],\n)\n' \
               "$tgt" "$dest" "$TAG" > ci-ghcr/BUILD.bazel
-            bazel run --remote_cache= --disk_cache="${BAZEL_DISK_CACHE}" //ci-ghcr:push
+            bazel run --stamp --remote_cache= --disk_cache="${BAZEL_DISK_CACHE}" //ci-ghcr:push
             rm -rf ci-ghcr
           done
           echo "Done: pushed ${#indexes[@]} image(s) under ${REGISTRY}/ at tag ${TAG}"
diff --git a/src/control-plane-services/function-autoscaler/tools/workspace_status.sh b/src/control-plane-services/function-autoscaler/tools/workspace_status.sh
index c4554d2b4..4725aff13 100755
--- a/src/control-plane-services/function-autoscaler/tools/workspace_status.sh
+++ b/src/control-plane-services/function-autoscaler/tools/workspace_status.sh
@@ -24,11 +24,28 @@ if [ "$COMMIT" != "unknown" ] && [ -n "$(git status --porcelain 2>/dev/null)" ];
 fi
 
 # CI overrides for VERSION (from git tag or MR sha) and BUILD_USER.
-# When unset, fall back to the values the legacy nvcf-cli Makefile computed.
+# When unset, use only tags that belong to this service. `git describe
+# --exact-match` is unsafe in the monorepo because a commit can also have
+# stack/chart tags such as deploy/stacks/nvcf-compute-plane/v...
+TAG_PREFIX="src/control-plane-services/function-autoscaler/v"
+LEGACY_TAG_PREFIX="nvcf-function-autoscaler-v"
+
+version_from_exact_tag() {
+    local prefix tag
+    for prefix in "$@"; do
+        tag=$(git tag --points-at HEAD --list "${prefix}*" 2>/dev/null | sort -V | tail -n1 || true)
+        if [ -n "${tag}" ]; then
+            printf '%s\n' "${tag#"${prefix}"}"
+            return 0
+        fi
+    done
+    return 1
+}
+
 if [ -n "${NVCF_VERSION:-}" ]; then
     VERSION="${NVCF_VERSION}"
-elif TAG=$(git describe --tags --exact-match HEAD 2>/dev/null); then
-    VERSION="${TAG}"
+elif VERSION=$(version_from_exact_tag "${TAG_PREFIX}" "${LEGACY_TAG_PREFIX}"); then
+    :
 else
     VERSION="mr-${COMMIT}"
 fi
diff --git a/src/invocation-plane-services/http-invocation/tools/workspace_status.sh b/src/invocation-plane-services/http-invocation/tools/workspace_status.sh
index c4554d2b4..4ed71ff1b 100755
--- a/src/invocation-plane-services/http-invocation/tools/workspace_status.sh
+++ b/src/invocation-plane-services/http-invocation/tools/workspace_status.sh
@@ -24,11 +24,28 @@ if [ "$COMMIT" != "unknown" ] && [ -n "$(git status --porcelain 2>/dev/null)" ];
 fi
 
 # CI overrides for VERSION (from git tag or MR sha) and BUILD_USER.
-# When unset, fall back to the values the legacy nvcf-cli Makefile computed.
+# When unset, use only tags that belong to this service. `git describe
+# --exact-match` is unsafe in the monorepo because a commit can also have
+# stack/chart tags such as deploy/stacks/nvcf-compute-plane/v...
+TAG_PREFIX="src/invocation-plane-services/http-invocation/v"
+LEGACY_TAG_PREFIX="nvcf-invocation-service-v"
+
+version_from_exact_tag() {
+    local prefix tag
+    for prefix in "$@"; do
+        tag=$(git tag --points-at HEAD --list "${prefix}*" 2>/dev/null | sort -V | tail -n1 || true)
+        if [ -n "${tag}" ]; then
+            printf '%s\n' "${tag#"${prefix}"}"
+            return 0
+        fi
+    done
+    return 1
+}
+
 if [ -n "${NVCF_VERSION:-}" ]; then
     VERSION="${NVCF_VERSION}"
-elif TAG=$(git describe --tags --exact-match HEAD 2>/dev/null); then
-    VERSION="${TAG}"
+elif VERSION=$(version_from_exact_tag "${TAG_PREFIX}" "${LEGACY_TAG_PREFIX}"); then
+    :
 else
     VERSION="mr-${COMMIT}"
 fi