diff --git a/.gitea/workflows/deploy-ift.yml b/.gitea/workflows/deploy-ift.yml
index 2afb582..db835e6 100644
--- a/.gitea/workflows/deploy-ift.yml
+++ b/.gitea/workflows/deploy-ift.yml
@@ -5,12 +5,19 @@ on:
     branches: [master, main]
   workflow_dispatch:
 
+env:
+  REGISTRY: git.sabilin.com/eventhub
+
 jobs:
   deploy-ift-core:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
 
+      - name: Compute image tag
+        id: meta
+        run: echo "tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
@@ -27,7 +34,9 @@ jobs:
           context: .
           file: docker/Dockerfile
           push: true
-          tags: git.sabilin.com/eventhub/eventhub:ift
+          tags: |
+            ${{ env.REGISTRY }}/eventhub:${{ steps.meta.outputs.tag }}
+            ${{ env.REGISTRY }}/eventhub:ift
 
       - name: Build and push traefik-coraza
         uses: docker/build-push-action@v4
@@ -35,7 +44,9 @@ jobs:
           context: docker/traefik
           file: docker/traefik/Dockerfile
           push: true
-          tags: git.sabilin.com/eventhub/traefik-coraza:ift
+          tags: |
+            ${{ env.REGISTRY }}/traefik-coraza:${{ steps.meta.outputs.tag }}
+            ${{ env.REGISTRY }}/traefik-coraza:ift
 
       - name: Build and push fallback
         uses: docker/build-push-action@v4
@@ -43,7 +54,9 @@ jobs:
           context: docker/fallback
           file: docker/fallback/Dockerfile
           push: true
-          tags: git.sabilin.com/eventhub/fallback:ift
+          tags: |
+            ${{ env.REGISTRY }}/fallback:${{ steps.meta.outputs.tag }}
+            ${{ env.REGISTRY }}/fallback:ift
 
       - name: Build and push bot-emulator
         uses: docker/build-push-action@v4
@@ -51,7 +64,9 @@ jobs:
           context: .
           file: test/emulate_users/Dockerfile
           push: true
-          tags: git.sabilin.com/eventhub/bot-emulator-users:ift
+          tags: |
+            ${{ env.REGISTRY }}/bot-emulator-users:${{ steps.meta.outputs.tag }}
+            ${{ env.REGISTRY }}/bot-emulator-users:ift
 
       - name: Deploy core on IFT via SSH
         uses: appleboy/ssh-action@v0.1.5
@@ -62,4 +77,4 @@ jobs:
           script: |
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            /opt/eventhub-ift/devops/scripts/deploy-service.sh ift core
+            /opt/eventhub-ift/devops/scripts/deploy-service.sh ift core ${{ steps.meta.outputs.tag }}
diff --git a/.gitea/workflows/deploy-stage.yml b/.gitea/workflows/deploy-stage.yml
index e9fc34d..d116328 100644
--- a/.gitea/workflows/deploy-stage.yml
+++ b/.gitea/workflows/deploy-stage.yml
@@ -6,12 +6,21 @@ on:
       - 'v*'
   workflow_dispatch:
 
+env:
+  REGISTRY: git.sabilin.com/eventhub
+
 jobs:
   deploy-stage-core:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
 
+      - name: Compute image tags
+        id: meta
+        run: |
+          echo "sha_tag=sha-${GITHUB_SHA::12}" >> "$GITHUB_OUTPUT"
+          echo "release_tag=${GITHUB_REF_NAME}" >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 
@@ -22,20 +31,29 @@ jobs:
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
-      - name: Build and push eventhub
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          push: true
-          tags: git.sabilin.com/eventhub/eventhub:stage
-
-      - name: Build and push bot-emulator
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          file: test/emulate_users/Dockerfile
-          push: true
-          tags: git.sabilin.com/eventhub/bot-emulator-users:stage
+      - name: Promote images (no rebuild)
+        run: |
+          set -euo pipefail
+          SHA="${{ steps.meta.outputs.sha_tag }}"
+          REL="${{ steps.meta.outputs.release_tag }}"
+          IMAGES="eventhub traefik-coraza fallback bot-emulator-users"
+          missing=""
+          for img in ${IMAGES}; do
+            if ! docker buildx imagetools inspect "${REGISTRY}/${img}:${SHA}" >/dev/null 2>&1; then
+              missing="${missing} ${img}"
+            fi
+          done
+          if [[ -n "${missing}" ]]; then
+            echo "Образы sha:${SHA} не найдены:${missing}"
+            echo "Сначала прогоните IFT deploy для этого коммита (push в master)."
+            exit 1
+          fi
+          for img in ${IMAGES}; do
+            docker buildx imagetools create \
+              -t "${REGISTRY}/${img}:${REL}" \
+              -t "${REGISTRY}/${img}:stage" \
+              "${REGISTRY}/${img}:${SHA}"
+          done
 
       - name: Deploy core on stage via SSH
         uses: appleboy/ssh-action@v0.1.5
@@ -46,4 +64,4 @@ jobs:
           script: |
             export REGISTRY_USER='${{ secrets.REGISTRY_USER }}'
             export REGISTRY_PASSWORD='${{ secrets.REGISTRY_PASSWORD }}'
-            /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core
+            /opt/eventhub-stage/devops/scripts/deploy-service.sh stage core ${{ steps.meta.outputs.release_tag }}