diff --git a/.gitea/workflows/build-push.yaml b/.gitea/workflows/build-push.yaml
index 5464ffc..7c832d0 100644
--- a/.gitea/workflows/build-push.yaml
+++ b/.gitea/workflows/build-push.yaml
@@ -29,6 +29,11 @@ on:
         required: false
         type: string
         default: ""
+      version:
+        description: "Optional version for pinned dev tags (e.g. '123' produces 'dev-v123'). Only applies on dev branch."
+        required: false
+        type: string
+        default: ""
       runner:
         description: "Runner label to use (e.g. ubuntu-latest, self-hosted-arm64). ARM64 builds use QEMU emulation on amd64 runners by default — set this to a native ARM64 runner for faster Rust/heavy builds."
         required: false
@@ -43,6 +48,9 @@ on:
       image-tag:
         description: "The sha-based image tag that was pushed"
         value: ${{ jobs.build.outputs.image-tag }}
+      env-tag:
+        description: "The environment tag that was pushed (prod, staging, dev, or dev-v{N})"
+        value: ${{ jobs.build.outputs.env-tag }}
 
 jobs:
   build:
@@ -53,6 +61,7 @@ jobs:
       options: --privileged
     outputs:
       image-tag: ${{ steps.tag.outputs.tag }}
+      env-tag: ${{ steps.tag.outputs.env-tag }}
     steps:
       - uses: actions/checkout@v4
 
@@ -64,6 +73,28 @@ jobs:
           SHORT_SHA="${SHORT_SHA:0:7}"
           echo "tag=sha-${SHORT_SHA}" >> "$GITEA_OUTPUT"
 
+          # Determine environment tag from branch
+          REF="${{ gitea.ref }}"
+          VERSION="${{ inputs.version }}"
+          case "$REF" in
+            refs/heads/main|refs/heads/master)
+              echo "env-tag=prod" >> "$GITEA_OUTPUT"
+              ;;
+            refs/heads/staging)
+              echo "env-tag=staging" >> "$GITEA_OUTPUT"
+              ;;
+            refs/heads/dev)
+              if [ -n "$VERSION" ]; then
+                echo "env-tag=dev-v${VERSION}" >> "$GITEA_OUTPUT"
+              else
+                echo "env-tag=dev" >> "$GITEA_OUTPUT"
+              fi
+              ;;
+            *)
+              echo "env-tag=" >> "$GITEA_OUTPUT"
+              ;;
+          esac
+
       - name: Log in to Gitea registry
         uses: docker/login-action@v3
         with:
@@ -79,6 +110,7 @@ jobs:
           tags: |
             type=sha,prefix=sha-
             type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ steps.tag.outputs.env-tag }},enable=${{ steps.tag.outputs.env-tag != '' }}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
 
diff --git a/.gitea/workflows/deploy-k8s.yaml b/.gitea/workflows/deploy-k8s.yaml
index 0b82024..d5a50ff 100644
--- a/.gitea/workflows/deploy-k8s.yaml
+++ b/.gitea/workflows/deploy-k8s.yaml
@@ -22,6 +22,11 @@ on:
         required: false
         type: string
         default: "wectrl-net/wectrl-k8s-cluster"
+      use-env-tag:
+        description: "If true, skip SHA-based manifest update (service uses mutable env tags with imagePullPolicy: Always)"
+        required: false
+        type: boolean
+        default: false
     secrets:
       GIT_USER:
         required: true
@@ -32,7 +37,7 @@ jobs:
   deploy:
     name: Update k8s Cluster Repo
     runs-on: ubuntu-latest
-    if: gitea.ref == 'refs/heads/main'
+    if: gitea.ref == 'refs/heads/main' && inputs.use-env-tag == false
     steps:
       - name: Install yq
         shell: bash
@@ -76,3 +81,61 @@ jobs:
             git push origin main
             echo "Cluster repo updated — ArgoCD will sync within ~3 min"
           fi
+
+  # When using mutable env tags, bump a deploy annotation so ArgoCD detects the change
+  notify-argocd:
+    name: Bump deploy annotation
+    runs-on: ubuntu-latest
+    if: inputs.use-env-tag == true
+    steps:
+      - name: Install yq
+        shell: bash
+        run: |
+          set -euo pipefail
+          ARCH=$(uname -m)
+          case "$ARCH" in
+            aarch64|arm64) YQ_ARCH="arm64" ;;
+            x86_64|amd64)  YQ_ARCH="amd64" ;;
+            *)             YQ_ARCH="amd64" ;;
+          esac
+          wget -qO /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.44.1/yq_linux_${YQ_ARCH}"
+          chmod +x /usr/local/bin/yq
+
+      - name: Bump annotation in cluster repo
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          SHA="${{ gitea.sha }}"
+          SHORT_SHA="${SHA:0:7}"
+          TIMESTAMP="$(date -u +%Y%m%d%H%M%S)"
+          RUN_URL="${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_id }}"
+
+          # Determine env from branch
+          REF="${{ gitea.ref }}"
+          case "$REF" in
+            refs/heads/main|refs/heads/master) ENV_TAG="prod" ;;
+            refs/heads/staging) ENV_TAG="staging" ;;
+            refs/heads/dev) ENV_TAG="dev" ;;
+            *) echo "Branch not mapped to environment, skipping"; exit 0 ;;
+          esac
+
+          git clone https://${{ secrets.GIT_USER }}:${{ secrets.GIT_TOKEN }}@git.wectrl.net/${{ inputs.k8s-repo }}.git
+          cd wectrl-k8s-cluster
+
+          git config user.email "ci@wectrl.net"
+          git config user.name "Gitea CI"
+
+          for DEPLOY_PATH in ${{ inputs.deploy-paths }}; do
+            yq -i '.spec.template.metadata.annotations."deploy.wectrl.net/restart" = "'"${TIMESTAMP}-sha-${SHORT_SHA}"'"' \
+              "${DEPLOY_PATH}"
+            git add "${DEPLOY_PATH}"
+          done
+
+          if git diff --staged --quiet; then
+            echo "No annotation changes to commit"
+          else
+            git commit -m "deploy: ${{ inputs.service-name }} ${ENV_TAG} (sha-${SHORT_SHA})"
+            git push origin main
+            echo "Annotation bumped — ArgoCD will roll pods within ~3 min"
+          fi