diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index 1e2f93960..57c3a04a5 100644
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -138,7 +138,7 @@ jobs:
             });
 
       - name: Re-tag container images with release version
-        if: ${{ github.event.inputs.dry_run == 'false' && steps.desc.outputs.nightly_tag != '' }}
+        if: ${{ github.event.inputs.dry_run == 'false' && github.event.inputs.require_docker != 'false' && steps.desc.outputs.nightly_tag != '' }}
         env:
           GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
         run: |
@@ -151,14 +151,23 @@ jobs:
 
           VARIANTS=("" "-cuda" "-cuda13" "-vulkan" "-rocm" "-intel" "-musa" "-openvino")
           TYPES=("full" "light" "server")
+          # the release is already created at this point, so keep going on a
+          # missing image and report all of them at the end
+          MISSING=()
           for type in "${TYPES[@]}"; do
             for variant in "${VARIANTS[@]}"; do
               src="${IMAGE_REPO}:${type}${variant}-${NIGHTLY_TAG}"
               dst="${IMAGE_REPO}:${type}${variant}-${VERSION}"
               echo "Tagging ${src} -> ${dst}"
-              docker buildx imagetools create --tag "${dst}" "${src}"
+              if ! docker buildx imagetools create --tag "${dst}" "${src}"; then
+                MISSING+=("${type}${variant}")
+              fi
             done
           done
+          if [[ ${#MISSING[@]} -gt 0 ]]; then
+            echo "::error::failed to re-tag container images for ${NIGHTLY_TAG}:${MISSING[*]}"
+            exit 1
+          fi
 
       - name: Dry run summary
         if: ${{ github.event.inputs.dry_run == 'true' }}
diff --git a/scripts/make-release-checks.sh b/scripts/make-release-checks.sh
index c0b81a170..a6f05902d 100755
--- a/scripts/make-release-checks.sh
+++ b/scripts/make-release-checks.sh
@@ -8,7 +8,8 @@
 #   GH_TOKEN, GITHUB_REPOSITORY, GITHUB_OUTPUT
 #   RELEASE_BRANCH: when set, HEAD must belong to origin/RELEASE_BRANCH and must
 #     not be older than 3 days from the branch HEAD (skipped when unset)
-#   REQUIRE_DOCKER: set to "false" to skip the container image check (default: true)
+#   REQUIRE_DOCKER: set to "false" to skip the container image check and the
+#     release re-tagging of the nightly images in make-release.yml (default: true)
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -128,7 +129,7 @@ if [[ -z "${NIGHTLY_TAG}" ]]; then
 elif [[ -z "${GITHUB_REPOSITORY:-}" ]]; then
     echo "Warning: GITHUB_REPOSITORY not set - skipping container image check (local run)"
 elif [[ "${REQUIRE_DOCKER:-true}" != "true" ]]; then
-    echo "Require Docker is disabled - skipping container image check"
+    echo "Require Docker is disabled - skipping container image check and re-tagging"
 else
     CONTAINER_REPO="${GITHUB_REPOSITORY,,}"  # lower-case owner/repo for ghcr.io
     GHCR_TOKEN="$(curl -fsSL \