diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ce583e537..1b83a1e4b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -60,6 +60,17 @@ jobs:
             slug: gitnexus
 
     steps:
+      - name: Validate tag input
+        if: github.event_name == 'workflow_call'
+        shell: bash
+        env:
+          TAG_INPUT: ${{ inputs.tag }}
+        run: |
+          if [ -z "${TAG_INPUT}" ]; then
+            echo "::error::No tag provided to docker.yml — refusing to build/push."
+            exit 1
+          fi
+
       # When triggered by workflow_call the caller passes the RC tag as an input;
       # we check out that tag so the Dockerfile and package.json match the built image.
       # For tag-push events github.ref is already the tag ref — no override needed.
diff --git a/.github/workflows/release-candidate.yml b/.github/workflows/release-candidate.yml
index 3e35a58ee..61782da1c 100644
--- a/.github/workflows/release-candidate.yml
+++ b/.github/workflows/release-candidate.yml
@@ -377,7 +377,7 @@ jobs:
   docker:
     name: Build & Push RC Docker images
     needs: [guard, publish]
-    if: needs.guard.outputs.should_run == 'true'
+    if: needs.guard.outputs.should_run == 'true' && needs.publish.outputs.vtag != ''
     uses: ./.github/workflows/docker.yml
     permissions:
       contents: read