diff --git a/.github/workflows/service-extensions-publish.yml b/.github/workflows/service-extensions-publish.yml
index ddf204b260..9e0c645be0 100644
--- a/.github/workflows/service-extensions-publish.yml
+++ b/.github/workflows/service-extensions-publish.yml
@@ -1,10 +1,21 @@
 name: Publish Service Extensions Callout images packages
 
-# on push in the PR branch
 on:
   push:
     branches:
       - 'flavien/service-extensions'
+  release:
+    types:
+      - published
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'Docker image tag to use for the package'
+        required: true
+        default: 'dev'
+      commit_sha:
+        description: 'Commit SHA to checkout'
+        required: true
 
 permissions:
   contents: read
@@ -14,8 +25,35 @@ jobs:
   publish-service-extensions:
     runs-on: ubuntu-latest
     steps:
+
+      - name: Get tag name
+        id: get_tag_name
+        run: |
+            if [ "${{ github.event_name }}" = "release" ]; then
+              echo "::set-output name=tag::${{ github.event.release.tag_name }}"
+              echo "Here1: tag=${{ github.event.release.tag_name }}"
+            else
+                if [ -z "${{ github.event.inputs.tag_name }}" ]; then
+                    echo "::set-output name=tag::dev"
+                    echo "Here2: tag=dev"
+                else
+                    echo "::set-output name=tag::${{ github.event.inputs.tag_name }}"
+                    echo "Here3: tag=${{ github.event.inputs.tag_name }}"
+                fi
+            fi
+            echo "Finally: ${{ steps.get_tag_name.outputs.tag }}"
+
       - name: Checkout
         uses: actions/checkout@v4
+        if: github.event_name == 'release'
+        with:
+          ref: ${{ steps.get_tag_name.outputs.tag }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        if: github.event_name != 'release'
+        with:
+          ref: ${{ github.event.inputs.commit_sha || github.sha }}
 
       - name: Set up Go 1.22
         uses: actions/setup-go@v5
@@ -33,13 +71,29 @@ jobs:
         shell: bash
         run: docker login -u publisher -p ${{ secrets.GITHUB_TOKEN }} ghcr.io
 
-      - name: Build and push
+      - name: Build and push [dev]
+        id: build-dev
+        if: github.event_name != 'release'
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./contrib/envoyproxy/envoy/cmd/serviceextensions/Dockerfile
           platforms: linux/amd64,linux/arm64
           push: true
-          tags: ghcr.io/datadog/dd-trace-go/service-extensions-callout:latest,ghcr.io/datadog/dd-trace-go/service-extensions-callout:${{ github.sha }}
-
+          tags: | # Use the commit SHA from the manual trigger or default to the SHA from the push event
+            ghcr.io/datadog/dd-trace-go/service-extensions-callout:${{ steps.get_tag_name.outputs.tag }}
+            ghcr.io/datadog/dd-trace-go/service-extensions-callout:${{ github.event.inputs.commit_sha || github.sha }}
 
+      - name: Build and push [release]
+        id: build-release
+        if: github.event_name == 'release'
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./contrib/envoyproxy/envoy/cmd/serviceextensions/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            ghcr.io/datadog/dd-trace-go/service-extensions-callout:latest
+            ghcr.io/datadog/dd-trace-go/service-extensions-callout:${{ steps.get_tag_name.outputs.tag }}
+            ghcr.io/datadog/dd-trace-go/service-extensions-callout:${{ github.sha }}
\ No newline at end of file