@@ -119,11 +119,12 @@ oci-output = $(if $(strip $(OCI_EXPORT_DIR)), --output type=oci$(comma)dest=$(OC
 # line. hack/stitch-multiarch.sh moves exactly those tags onto the multi-arch
 # index; no ref in the tree names a versioned tag, so this is how it learns
 # one was pushed. The append happens when the recipe is expanded, `make -n`
-# included, and is skipped under OCI_EXPORT_DIR, which pushes nothing.
+# included, and is skipped when the build pushes nothing (PUSH other than 1, or
+# OCI_EXPORT_DIR).
 image-tag-refs = $(REGISTRY)/$(1):$(IMAGE_TAG)$(if $(strip $(OCI_EXPORT_DIR)),,$(if $(filter 1,$(PUBLISH_VERSIONED)),$(if $(filter-out $(IMAGE_TAG),$(strip $(2))), $(REGISTRY)/$(1):$(strip $(2))))$(if $(filter 1,$(PUBLISH_FLOATING)), $(REGISTRY)/$(1):latest))
 
 define image-tags
-$(foreach r,$(call image-tag-refs,$(1),$(2)),--tag $(r))$(call oci-output,$(1))$(if $(and $(strip $(PUSHED_TAGS_LOG)),$(if $(strip $(OCI_EXPORT_DIR)),,1)),$(shell printf '%s\n' $(call image-tag-refs,$(1),$(2)) >>'$(PUSHED_TAGS_LOG)'))
+$(foreach r,$(call image-tag-refs,$(1),$(2)),--tag $(r))$(call oci-output,$(1))$(if $(and $(strip $(PUSHED_TAGS_LOG)),$(filter 1,$(PUSH)),$(if $(strip $(OCI_EXPORT_DIR)),,1)),$(shell printf '%s\n' $(call image-tag-refs,$(1),$(2)) >>'$(PUSHED_TAGS_LOG)'))
 endef
 
 # cache-args <image-name>
 
@@ -185,7 +185,7 @@
   if echo "$tags" | grep -q -- '-$'; then echo "FAIL: a tag ends in '-': $tags"; false; fi
 }
 
-@test "image-tags records every tag it pushes in PUSHED_TAGS_LOG, and nothing when unset or exporting" {
+@test "image-tags records every tag it pushes in PUSHED_TAGS_LOG, and nothing when unset, exporting or not pushing" {
   # The stitch moves exactly these tags onto the multi-arch index. A component
   # version pushed under PUBLISH_VERSIONED=1 is named by no ref in the tree, so
   # a tag missing here would stay on the amd64-only image.
@@ -200,6 +200,10 @@
   make -n -C packages/system/cozystack-controller image IMAGE_TAG=pr-1-abc BUILDER=b \
     OCI_EXPORT_DIR=/tmp/ocitest PUSHED_TAGS_LOG="$tmp/export-log" >/dev/null
   [ ! -e "$tmp/export-log" ]
+  # A build that does not push must not hand its tags to the stitch.
+  LOAD=1 make -n -C packages/system/cozystack-controller image IMAGE_TAG=pr-1-abc BUILDER=b \
+    PUSHED_TAGS_LOG="$tmp/load-log" >/dev/null
+  if [ -s "$tmp/load-log" ]; then echo "FAIL: LOAD=1 logs tags it never pushed: $(cat "$tmp/load-log")"; false; fi
   rm -rf "$tmp"
 }
 
 
@@ -21,10 +21,11 @@
 #      if it points at A, so none is left naming the amd64 half alone: <tag>,
 #      the tag <t> the ref carries, and every <repo>:<tag> line in the file
 #      PUSHED_TAGS_LOG names. image-tags in hack/common-envs.mk writes that
-#      log when the variable is set, and it is how the component version
-#      pushed beside <image-tag> under PUBLISH_VERSIONED=1 is found, since
-#      most refs name only <image-tag>. These are the only tags read; a tag of
-#      another build that sits on the same bytes is not this build's to move.
+#      log when the variable is set and PUSH=1, and it is how the component
+#      version pushed beside <image-tag> under PUBLISH_VERSIONED=1 is found,
+#      since most refs name only <image-tag>. These are the only tags read;
+#      a tag of another build that sits on the same bytes is not this build's
+#      to move.
 #      PUSHED_TAGS_LOG set to a file that does not exist fails the run.
 #   3. A is replaced with the index digest in the files hack/lib/image-refs.sh
 #      enumerates, and nowhere else.