diff --git a/templates/gitlab-ci-docker.yml b/templates/gitlab-ci-docker.yml
index 3de1553ec12d1c1727257ef1d184d91ca76207e3..a2a2b36539f0e8bd282b3e22786655fb3d46d499 100644
--- a/templates/gitlab-ci-docker.yml
+++ b/templates/gitlab-ci-docker.yml
@@ -828,6 +828,7 @@ stages:
       cp -f "$BUILDTOOL_HOME/.docker/config.json" "$BUILDTOOL_HOME/skopeo/.docker/src-config.json"
       # use a merged auth config for the destination image
       echo "${docker_release_config_json}" > "$BUILDTOOL_HOME/skopeo/.docker/release-only.json"
+      maybe_install_python3
       merge_json "$BUILDTOOL_HOME/skopeo/.docker/src-config.json" "$BUILDTOOL_HOME/skopeo/.docker/release-only.json" > "$BUILDTOOL_HOME/skopeo/.docker/dest-config.json"
     fi
 
@@ -860,7 +861,6 @@ stages:
   function init_workspace() {
     install_custom_ca_certs
     maybe_install_awk
-    maybe_install_python3
     unscope_variables
     eval_all_secrets
     configure_registries_auth
@@ -960,6 +960,7 @@ stages:
       return
     fi
     # check if tag matches pattern
+    maybe_install_python3
     # shellcheck disable=SC2154
     matches=$(python3 -c "import re;print('match' if re.match(r'$DOCKER_RELEASE_EXTRA_TAGS_PATTERN', '$docker_tag') else '')")
     if [[ "$matches" ]]