diff --git a/.github/workflows/approve-bot-pr.yml b/.github/workflows/approve-bot-pr.yml
index f1d1355..14bef90 100644
--- a/.github/workflows/approve-bot-pr.yml
+++ b/.github/workflows/approve-bot-pr.yml
@@ -66,4 +66,4 @@ jobs:
       run: |
         gh pr merge ${{ needs.download.outputs.pr-number }} --auto --rebase
       env:
-        GITHUB_TOKEN: ${{ secrets.PAKETO_BOT_GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.PAKETO_BOT_REVIEWER_GITHUB_TOKEN }}
diff --git a/.github/workflows/push-image.yml b/.github/workflows/push-image.yml
index 2afdb23..ad5ec9c 100644
--- a/.github/workflows/push-image.yml
+++ b/.github/workflows/push-image.yml
@@ -91,7 +91,23 @@ jobs:
         ./scripts/publish.sh --builder-toml-path "${{ matrix.builders.path }}/builder.toml" \
           --builder-image-ref "${IMAGE_REF}"
 
-        ./.bin/crane tag "${IMAGE_REF}" latest
+        EXPECTED_PLATFORMS=$(grep -c '^\[\[targets\]\]' "${{ matrix.builders.path }}/builder.toml" || true)
+        if [ "${EXPECTED_PLATFORMS}" -eq 0 ]; then
+          EXPECTED_PLATFORMS=1
+        fi
+
+        MAX_ATTEMPTS=12
+        for _ in $(seq 1 "${MAX_ATTEMPTS}"); do
+          ./.bin/crane manifest "${IMAGE_REF}" > manifest.json
+          PLATFORMS=$(jq 'if .manifests then (.manifests | length) else 1 end' manifest.json)
+          if [ "${PLATFORMS}" -eq "${EXPECTED_PLATFORMS}" ]; then
+            ./.bin/crane tag "${DOCKERHUB_ORG}/${CONTAINER_REPO}@sha256:$(sha256sum manifest.json | cut -d ' ' -f 1)" latest
+            exit 0
+          fi
+          sleep 5
+        done
+        echo "::error::${IMAGE_REF} has ${PLATFORMS} platforms, expected ${EXPECTED_PLATFORMS}"
+        exit 1
 
   failure:
     name: Alert on Failure