diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 48f459db..0cc526c8 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -40,8 +40,10 @@ jobs:
             org.opencontainers.image.title=beacon-server
             org.opencontainers.image.description=Beacon — MeshCore LoRa mesh observation server
             org.opencontainers.image.licenses=AGPL-3.0-or-later
+          flavor: |
+            latest=false
           tags: |
-            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
             type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
diff --git a/internal/ingest/packet_summary_test.go b/internal/ingest/packet_summary_test.go
index 887c3960..7f17aba2 100644
--- a/internal/ingest/packet_summary_test.go
+++ b/internal/ingest/packet_summary_test.go
@@ -6,6 +6,7 @@ package ingest
 import (
 	"context"
 	"crypto/ed25519"
+	"crypto/rand"
 	"encoding/json"
 	"testing"
 	"time"
@@ -24,7 +25,20 @@ func waitForSummarySubscriber(t *testing.T, ctx context.Context, h *hub.Hub, cli
 		h.Broadcast(hub.Event{Type: hub.EventObserverStatus})
 		select {
 		case <-client.Send:
-			return
+			// A slow hub can leave more probes queued. Drain through a final
+			// marker so the next test read receives its packet, not a probe.
+			marker := json.RawMessage(`"` + rand.Text() + `"`)
+			h.Broadcast(hub.Event{Type: hub.EventObserverStatus, Payload: marker})
+			for {
+				select {
+				case event := <-client.Send:
+					if string(event.Payload) == string(marker) {
+						return
+					}
+				case <-ctx.Done():
+					t.Fatal("hub readiness probes did not drain")
+				}
+			}
 		case <-ticker.C:
 		case <-ctx.Done():
 			t.Fatal("hub subscription did not become ready")