diff --git a/.gitea/workflows/build-v2.yml b/.gitea/workflows/build-v2.yml
index a1437bd..624df4e 100644
--- a/.gitea/workflows/build-v2.yml
+++ b/.gitea/workflows/build-v2.yml
@@ -264,9 +264,12 @@ jobs:
       # ------------------------------------------------------------
       # Install Cosign
       # ------------------------------------------------------------
+      # HINWEIS (labwc-Zweig): Auch Test-Tags werden signiert, damit sie die
+      # lokale sigstoreSigned-Policy bestehen. Test-Images bleiben an ihrem
+      # test-*-Tag erkennbar; :stable wird dadurch nicht beruehrt.
 
       - name: Install Cosign
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
+        if: github.event_name != 'pull_request'
         uses: sigstore/cosign-installer@v4.1.2
 
       # ------------------------------------------------------------
@@ -274,7 +277,7 @@ jobs:
       # ------------------------------------------------------------
 
       - name: Sign container image (Recursive Digest)
-        if: github.event_name != 'pull_request' && env.IS_TEST_BUILD == 'false'
+        if: github.event_name != 'pull_request'
         env:
           COSIGN_PRIVATE_KEY: ${{ secrets.SIGNING_SECRET }}
           COSIGN_PASSWORD: ""
@@ -291,7 +294,7 @@ jobs:
           OUTER_DIGEST=$(
             skopeo inspect \
               --creds "${{ github.repository_owner }}:${{ secrets.REGISTRY }}" \
-              "docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.DEFAULT_TAG }}" \
+              "docker://${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}" \
               | jq -r .Digest
           )