diff --git a/.github/workflows/stackhpc-container-image-build.yml b/.github/workflows/stackhpc-container-image-build.yml
index 502e6c824..01485c256 100644
--- a/.github/workflows/stackhpc-container-image-build.yml
+++ b/.github/workflows/stackhpc-container-image-build.yml
@@ -18,23 +18,83 @@ on:
         type: boolean
         required: false
         default: false
-      distro:
-        description: Container image OS distribution
-        type: choice
+      centos-stream-8:
+        description: Build CentOS Stream 8 images?
+        type: boolean
+        required: false
+        default: true
+      ubuntu-focal:
+        description: Build Ubuntu Focal 20.04 images?
+        type: boolean
         required: false
-        default: centos
-        options:
-          - centos
-          - ubuntu
+        default: true
+      push:
+        description: Whether to push images
+        type: boolean
+        required: false
+        default: true
 
 env:
   ANSIBLE_FORCE_COLOR: True
 jobs:
+  generate-tag:
+    name: Generate container image tag
+    if: github.repository == 'stackhpc/stackhpc-kayobe-config'
+    runs-on: [self-hosted, stackhpc-kayobe-config-kolla-builder]
+    permissions: {}
+    outputs:
+      kolla_tag: ${{ steps.kolla_tag.outputs.kolla_tag }}
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+      openstack_release: ${{ steps.openstack_release.outputs.openstack_release }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Determine OpenStack release
+        id: openstack_release
+        run: |
+          BRANCH=$(awk -F'=' '/defaultbranch/ {print $2}' .gitreview)
+          echo "openstack_release=${BRANCH}" | sed "s|stable/||" >> $GITHUB_OUTPUT
+
+      # Generate a tag to apply to all built container images.
+      # Without this, each kayobe * container image build command would use a different tag.
+      - name: Generate container image tag
+        id: kolla_tag
+        run: |
+          echo "kolla_tag=$(date +${{ steps.openstack_release.outputs.openstack_release }}-%Y%m%dT%H%M%S)" >> $GITHUB_OUTPUT
+
+      # Dynamically define job matrix.
+      # We need a separate matrix entry for each distribution, when the relevant input is true.
+      # https://stackoverflow.com/questions/65384420/how-do-i-make-a-github-action-matrix-element-conditional
+      - name: Generate build matrix
+        id: set-matrix
+        run: |
+          comma=""
+          echo -n "matrix={\"distro\": [" >> $GITHUB_OUTPUT
+          if [[ ${{ inputs.centos-stream-8 }} == 'true' ]]; then
+            echo -n "$comma\"centos\"" >> $GITHUB_OUTPUT
+            comma=", "
+          fi
+          if [[ ${{ inputs.ubuntu-focal }} == 'true' ]]; then
+            echo -n "$comma\"ubuntu\"" >> $GITHUB_OUTPUT
+            comma=", "
+          fi
+          echo "]}" >> $GITHUB_OUTPUT
+
+      - name: Display container image tag
+        run: |
+          echo "${{ steps.kolla_tag.outputs.kolla_tag }}"
+
   container-image-build:
     name: Build Kolla container images
     if: github.repository == 'stackhpc/stackhpc-kayobe-config'
     runs-on: [self-hosted, stackhpc-kayobe-config-kolla-builder]
     timeout-minutes: 720
+    permissions: {}
+    strategy:
+      matrix: ${{ fromJson(needs.generate-tag.outputs.matrix) }}
+    needs:
+      - generate-tag
     steps:
       - uses: actions/checkout@v3
         with:
@@ -44,7 +104,7 @@ jobs:
         uses: actions/checkout@v3
         with:
           repository: stackhpc/kayobe
-          ref: refs/heads/stackhpc/xena
+          ref: refs/heads/stackhpc/${{ needs.generate-tag.outputs.openstack_release }}
           path: src/kayobe
 
       # FIXME: Failed in kolla-ansible : Ensure the latest version of pip is installed
@@ -100,57 +160,43 @@ jobs:
 
       - name: Build and push kolla overcloud images
         run: |
+          args="${{ github.event.inputs.regexes }}"
+          args="$args -e kolla_base_distro=${{ matrix.distro }}"
+          args="$args -e kolla_tag=${{ needs.generate-tag.outputs.kolla_tag }}"
+          if ${{ inputs.push }} == 'true'; then
+            args="$args --push"
+          fi
           source venvs/kayobe/bin/activate &&
           source src/kayobe-config/kayobe-env --environment ci-builder &&
-          kayobe overcloud container image build ${{ github.event.inputs.regexes }} --push -e kolla_base_distro=${{ inputs.distro }}
+          kayobe overcloud container image build $args
         env:
           KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
         if: github.event.inputs.overcloud == 'true'
 
-      - name: Display the overcloud container image tag
-        run: |
-          echo "$(cat ~/kolla_tag)"
-        if: github.event.inputs.overcloud == 'true'
-
-      - name: Get built overcloud container images
-        run: |
-          sudo docker image ls --filter "reference=ark.stackhpc.com/stackhpc-dev/*:$(cat ~/kolla_tag)" > overcloud-container-images
-        if: github.event.inputs.overcloud == 'true'
-
-      - name: Upload overcloud-container-images artifact
-        uses: actions/upload-artifact@v3
-        with:
-          name: Overcloud container images
-          path: overcloud-container-images
-          retention-days: 7
-        if: github.event.inputs.overcloud == 'true'
-
       - name: Build and push kolla seed images
         run: |
+          args="kolla_base_distro=${{ matrix.distro }}"
+          args="$args -e kolla_tag=${{ needs.generate-tag.outputs.kolla_tag }}"
+          if ${{ inputs.push }} == 'true'; then
+            args="$args --push"
+          fi
           source venvs/kayobe/bin/activate &&
           source src/kayobe-config/kayobe-env --environment ci-builder &&
-          kayobe seed container image build --push -e kolla_base_distro=${{ inputs.distro }}
+          kayobe seed container image build $args
         env:
           KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
         if: github.event.inputs.seed == 'true'
 
-      - name: Display the seed container image tag
-        run: |
-          echo "$(cat ~/kolla_tag)"
-        if: github.event.inputs.seed == 'true'
-
-      - name: Get built seed container images
+      - name: Get built container images
         run: |
-          sudo docker image ls --filter "reference=ark.stackhpc.com/stackhpc-dev/*:$(cat ~/kolla_tag)" > seed-container-images
-        if: github.event.inputs.seed == 'true'
+          sudo docker image ls --filter "reference=ark.stackhpc.com/stackhpc-dev/${{ matrix.distro }}-*:${{ needs.generate-tag.outputs.kolla_tag }}" > ${{ matrix.distro }}-container-images
 
-      - name: Upload seed-container-images artifact
+      - name: Upload container images artifact
         uses: actions/upload-artifact@v3
         with:
-          name: Seed container images
-          path: seed-container-images
+          name: ${{ matrix.distro }} container images
+          path: ${{ matrix.distro }}-container-images
           retention-days: 7
-        if: github.event.inputs.seed == 'true'
 
       - name: Prune local Kolla container images over 1 week old
         run: |
@@ -160,8 +206,9 @@ jobs:
     name: Trigger container image repository sync
     needs:
       - container-image-build
-    if: github.repository == 'stackhpc/stackhpc-kayobe-config'
+    if: github.repository == 'stackhpc/stackhpc-kayobe-config' && inputs.push
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       # NOTE(mgoddard): Trigger another CI workflow in the
       # stackhpc-release-train repository.
diff --git a/.github/workflows/stackhpc-promote.yml b/.github/workflows/stackhpc-promote.yml
index 69a245baf..ab1a0640f 100644
--- a/.github/workflows/stackhpc-promote.yml
+++ b/.github/workflows/stackhpc-promote.yml
@@ -10,6 +10,7 @@ jobs:
     name: Trigger package repository promotion
     if: github.repository == 'stackhpc/stackhpc-kayobe-config'
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       # NOTE(mgoddard): Trigger another CI workflow in the
       # stackhpc-release-train repository.
diff --git a/doc/source/contributor/environments/ci-builder.rst b/doc/source/contributor/environments/ci-builder.rst
index 17b73ad1c..9df7426b5 100644
--- a/doc/source/contributor/environments/ci-builder.rst
+++ b/doc/source/contributor/environments/ci-builder.rst
@@ -105,10 +105,7 @@ At this point you are ready to build and push some container images.
    kayobe seed container image build --push
    kayobe overcloud container image build --push
 
-The container images are tagged as |current_release|-<datetime>. This Kayobe
-configuration includes a hook that writes the tag to ``~/kolla_tag``, since
-it is not always simple to determine which tag was last applied to built
-images.
+The container images are tagged as |current_release|-<datetime>.
 
 To use the new images, edit
 ``~/src/kayobe-config/etc/kayobe/kolla.yml`` to set the above
diff --git a/etc/kayobe/ansible/write-kolla-tag.yml b/etc/kayobe/ansible/write-kolla-tag.yml
deleted file mode 100644
index e0099bb87..000000000
--- a/etc/kayobe/ansible/write-kolla-tag.yml
+++ /dev/null
@@ -1,19 +0,0 @@
----
-- name: Write out value of kolla_tag
-  hosts: localhost
-  gather_facts: no
-  vars:
-    kolla_tag_dest: ~/kolla_tag
-  tasks:
-    - name: Query image tag
-      shell:
-        cmd: >-
-          grep '^tag' {{ kolla_build_config_path }}/kolla-build.conf |
-          sed 's/tag\s=\s\(.*\)/\1/'
-      become: true
-      register: tag
-
-    - name: Write out value of kolla_tag
-      copy:
-        content: "{{ tag.stdout }}"
-        dest: "{{ kolla_tag_dest }}"
diff --git a/etc/kayobe/hooks/overcloud-container-image-build/post.d/50-write-kolla-tag.yml b/etc/kayobe/hooks/overcloud-container-image-build/post.d/50-write-kolla-tag.yml
deleted file mode 120000
index c685974a2..000000000
--- a/etc/kayobe/hooks/overcloud-container-image-build/post.d/50-write-kolla-tag.yml
+++ /dev/null
@@ -1 +0,0 @@
-../../../ansible/write-kolla-tag.yml
\ No newline at end of file
diff --git a/etc/kayobe/hooks/seed-container-image-build/post.d/50-write-kolla-tag.yml b/etc/kayobe/hooks/seed-container-image-build/post.d/50-write-kolla-tag.yml
deleted file mode 120000
index c685974a2..000000000
--- a/etc/kayobe/hooks/seed-container-image-build/post.d/50-write-kolla-tag.yml
+++ /dev/null
@@ -1 +0,0 @@
-../../../ansible/write-kolla-tag.yml
\ No newline at end of file