diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index 2ca93bb3..e5e9e236 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -23,7 +23,7 @@ env:
   ARTIFACT_NAME: alfresco-docker-images
   REGISTRY: ghcr.io
   REGISTRY_NAMESPACE: alfresco
-  TAG: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.sha }}
+  TAG: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.ref_name }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name || github.run_id }}
diff --git a/.github/workflows/cleanup_images.yml b/.github/workflows/cleanup_images.yml
index 58595874..4b3a59d2 100644
--- a/.github/workflows/cleanup_images.yml
+++ b/.github/workflows/cleanup_images.yml
@@ -6,11 +6,17 @@ on:
   schedule:
     - cron: '0 0 */14 * *'  # Every 2 weeks
   workflow_dispatch:
+    inputs:
+      dry-run:
+        description: 'If set to false, images will be deleted'
+        required: false
+        default: 'true'
 
 permissions:
   packages: write
 
 env:
+  KEEP_AMOUNT: 1 # onetime cleanup
   ORG: Alfresco
   REPO: alfresco-dockerfiles-bakery
 
@@ -45,8 +51,8 @@ jobs:
           repository: ${{ env.REPO }}
           packages: ${{ env.PACKAGE_NAMES }}
           delete-tags: ${{format('pr-{0}', github.event.pull_request.number)}}
-          dry-run: true
-      - name: Remove untaged images
+          dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry-run || 'true' }} 
+      - name: Remove untaged images and keep latest ${{ env.KEEP_AMOUNT }} images
         uses: dataaxiom/ghcr-cleanup-action@98b4022383d6ddb70ccbf6a378b4d8c67a60f066
         if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
         with:
@@ -54,5 +60,6 @@ jobs:
           owner: ${{ env.ORG }}
           repository: ${{ env.REPO }}
           packages: ${{ env.PACKAGE_NAMES }}
+          keep-n-tagged: ${{ env.KEEP_AMOUNT }} # onetime cleanup
           delete-untagged: true
-          dry-run: true
+          dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry-run || 'true' }}