diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 32c824b..3d70d07 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -29,6 +29,24 @@ docker:
   only:
     - tags
 
+docker-latest:
+  stage: publish
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [""]
+  variables:
+    PYTHON_VERSION: "3.10"
+  tags:
+    - docker
+  script:
+    - sed "s/{{PYVERSION}}/$PYTHON_VERSION/" Dockerfile.template > Dockerfile
+    - echo "{\"auths\":{\"$CI_REGISTRY\":{\"username\":\"$CI_REGISTRY_USER\",\"password\":\"$CI_REGISTRY_PASSWORD\"},\"https://index.docker.io/v1/\":{\"auth\":\"$HUB_AUTH\"}}}" > /kaniko/.docker/config.json
+    # The skip-tls-verify flag is there because our registry certificate is self signed
+    - /kaniko/executor --context $CI_PROJECT_DIR --skip-tls-verify --dockerfile $CI_PROJECT_DIR/Dockerfile --destination $HUB_REPO:$CI_COMMIT_SHORT_SHA
+  only:
+    refs:
+      - master
+
 testpy37:
   tags:
     - docker
@@ -73,7 +91,7 @@ check_pypi:
   when: delayed
   start_in: 10 minutes
 
-deploy:
+latest-demo:
   only:
     refs:
       - master
@@ -84,7 +102,7 @@ deploy:
   environment: production
   variables:
     KUBECONFIG_FILE: "/kubeconfig"
-    IMAGEWTAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_TAG}"
+    IMAGEWTAG: "${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}"
     KUBEAPP: "senpy"
   script:
   - cat ${KUBECONFIG} > $KUBECONFIG_FILE