diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d0e23c60c09bb9f8f3fbe42d06a4f601b38aaae0..2409e6351e734540892bc2e479e51598fa79dd85 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -27,6 +27,7 @@ stages:
 - hotfix-prepare
 - cluster-tests
 - diagnostic-tools
+- tag-image
 - release
 
 include:
diff --git a/ci/build-image.yaml b/ci/build-image.yaml
index 7d98030aae83b051cb8eaa9d29a87bbe5a661562..2aaa8666bc970294ec4570937b031a793174d7dc 100644
--- a/ci/build-image.yaml
+++ b/ci/build-image.yaml
@@ -42,19 +42,24 @@ build_image:
 deploy_image:
   tags:
     - docker
-  image:
-    name: "quay.io/skopeo/stable:latest"
-    entrypoint: ["/bin/bash"]
-  stage: release
+  image: "${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/nixos/nix:2.21.2"
+  stage: tag-image
   rules:
     - if: $CI_COMMIT_REF_NAME == $YAOOK_K8S_DEFAULT_BRANCH
       when: on_success
     - if: '$CI_COMMIT_BRANCH =~ $REGEX_RELEASE_BRANCH_PREFIX'
       when: on_success
+  before_script:
+    - |
+      cat > /etc/nix/nix.conf <<EOF
+      build-users-group = nixbld
+      sandbox = false
+      extra-experimental-features = nix-command flakes
+      EOF
   script:
-  - skopeo login -u gitlab-ci-token -p "${CI_JOB_TOKEN}" "${CI_REGISTRY}"
-  - skopeo --insecure-policy copy "docker://${YAOOK_K8S_CI_IMAGE_NAME}:${YAOOK_K8S_CI_IMAGE_TAG}" "docker://${YAOOK_K8S_CI_IMAGE_NAME}:${CI_COMMIT_REF_NAME}"
+  - nix run nixpkgs#skopeo login -u gitlab-ci-token -p "${CI_JOB_TOKEN}" "${CI_REGISTRY}"
+  - nix run nixpkgs#skopeo --insecure-policy copy "docker://${YAOOK_K8S_CI_IMAGE_NAME}:${YAOOK_K8S_CI_IMAGE_TAG}" "docker://${YAOOK_K8S_CI_IMAGE_NAME}:${CI_COMMIT_REF_NAME}"
   - |
     if [ "$CI_COMMIT_REF_NAME" == "$CI_DEFAULT_BRANCH" ]; then
-      skopeo --insecure-policy copy "docker://${YAOOK_K8S_CI_IMAGE_NAME}:${YAOOK_K8S_CI_IMAGE_TAG}" "docker://${YAOOK_K8S_CI_IMAGE_NAME}:latest";
+      nix run nixpkgs#skopeo --insecure-policy copy "docker://${YAOOK_K8S_CI_IMAGE_NAME}:${YAOOK_K8S_CI_IMAGE_TAG}" "docker://${YAOOK_K8S_CI_IMAGE_NAME}:latest";
     fi
diff --git a/ci/cluster-tests.yaml b/ci/cluster-tests.yaml
index b937f402d46a6df0e1939dca0d5371212149aecf..7c57a186aa6f4b01781e71ce8ce85224e65931d7 100644
--- a/ci/cluster-tests.yaml
+++ b/ci/cluster-tests.yaml
@@ -243,12 +243,12 @@
     - MANAGED_K8S_RELEASE_THE_KRAKEN=true ./managed-k8s/actions/update-kubernetes-nodes.sh
     - ./managed-k8s/actions/test.sh
   after_script:
+    # artifacts are overridden by later stages, so we need to re-export the variable here
+    # for context see https://gitlab.com/yaook/k8s/-/merge_requests/1175#note_1959887865
+    - echo "YAOOK_K8S_CI_IMAGE_TAG=$YAOOK_K8S_CI_IMAGE_TAG" > ci/image.env
     - cd ci/
     - eval $(direnv export bash) # This mimics `cd`ing into the directory with an interactive shell
     - ./after_script_cleanup.sh
-    # artifacts are overridden by later stages, so we need to re-export the variable here
-    # for context see https://gitlab.com/yaook/k8s/-/merge_requests/1175#note_1959887865
-    - echo "YAOOK_K8S_CI_IMAGE_TAG=$YAOOK_K8S_CI_IMAGE_TAG" > image.env
 
   artifacts:
     reports: