diff --git a/.albatros b/.albatros
index 9bc5bc3..f95cde2 100755
--- a/.albatros
+++ b/.albatros
@@ -4,12 +4,7 @@ set -euxo pipefail
 nix run .#build-static
 nix run .#build-container
 
-if [[ $BRANCH == "main" && -f $SECRET_PATH ]]; then
-# Load secrets
-set +x
-source $SECRET_PATH
-set -x
-
+if [[ ! -z $TAG && ! -z $DOCKER_AUTH ]]; then
 # Configure Docker Auth
 mkdir .docker
 cat > .docker/config.json <<EOF
diff --git a/example/forgejo.hook.tag.json b/example/forgejo.hook.tag.json
new file mode 100644
index 0000000..279906a
--- /dev/null
+++ b/example/forgejo.hook.tag.json
@@ -0,0 +1,110 @@
+{
+  "sha": "e681ec50dc298db4fc3f6eb87f12f97afadb3210",
+  "ref": "0.9.0-rc.1",
+  "ref_type": "tag",
+  "repository": {
+    "id": 270,
+    "owner": {
+      "id": 3,
+      "login": "Deuxfleurs",
+      "login_name": "",
+      "full_name": "",
+      "email": "",
+      "avatar_url": "https://git.deuxfleurs.fr/avatars/9f7f0ddf4e41327d9b02aff0a559ea0b",
+      "language": "",
+      "is_admin": false,
+      "last_login": "0001-01-01T00:00:00Z",
+      "created": "2020-01-28T19:09:02Z",
+      "restricted": false,
+      "active": false,
+      "prohibit_login": false,
+      "location": "Rennes, France",
+      "website": "https://deuxfleurs.fr",
+      "description": "",
+      "visibility": "public",
+      "followers_count": 0,
+      "following_count": 0,
+      "starred_repos_count": 0,
+      "username": "Deuxfleurs"
+    },
+    "name": "albatros",
+    "full_name": "Deuxfleurs/albatros",
+    "description": "Tools to build a software supply chain on your own",
+    "empty": false,
+    "private": false,
+    "fork": false,
+    "template": false,
+    "parent": null,
+    "mirror": false,
+    "size": 798,
+    "language": "",
+    "languages_url": "https://git.deuxfleurs.fr/api/v1/repos/Deuxfleurs/albatros/languages",
+    "html_url": "https://git.deuxfleurs.fr/Deuxfleurs/albatros",
+    "link": "",
+    "ssh_url": "git@git.deuxfleurs.fr:Deuxfleurs/albatros.git",
+    "clone_url": "https://git.deuxfleurs.fr/Deuxfleurs/albatros.git",
+    "original_url": "",
+    "website": "",
+    "stars_count": 0,
+    "forks_count": 0,
+    "watchers_count": 9,
+    "open_issues_count": 5,
+    "open_pr_counter": 0,
+    "release_counter": 0,
+    "default_branch": "main",
+    "archived": false,
+    "created_at": "2023-03-14T17:52:11Z",
+    "updated_at": "2023-05-04T14:15:25Z",
+    "permissions": {
+      "admin": false,
+      "push": false,
+      "pull": false
+    },
+    "has_issues": true,
+    "internal_tracker": {
+      "enable_time_tracker": true,
+      "allow_only_contributors_to_track_time": true,
+      "enable_issue_dependencies": true
+    },
+    "has_wiki": true,
+    "has_pull_requests": true,
+    "has_projects": true,
+    "ignore_whitespace_conflicts": false,
+    "allow_merge_commits": true,
+    "allow_rebase": true,
+    "allow_rebase_explicit": true,
+    "allow_squash_merge": true,
+    "allow_rebase_update": true,
+    "default_delete_branch_after_merge": false,
+    "default_merge_style": "merge",
+    "default_allow_maintainer_edit": false,
+    "avatar_url": "",
+    "internal": false,
+    "mirror_interval": "",
+    "mirror_updated": "0001-01-01T00:00:00Z",
+    "repo_transfer": null
+  },
+  "sender": {
+    "id": 4,
+    "login": "quentin",
+    "login_name": "",
+    "full_name": "Quentin",
+    "email": "quentin@dufour.io",
+    "avatar_url": "https://git.deuxfleurs.fr/avatars/b081d05777a68620eb6e3ca16a753b6a",
+    "language": "",
+    "is_admin": false,
+    "last_login": "0001-01-01T00:00:00Z",
+    "created": "2020-01-29T06:55:51Z",
+    "restricted": false,
+    "active": false,
+    "prohibit_login": false,
+    "location": "",
+    "website": "https://quentin.dufour.io",
+    "description": "",
+    "visibility": "public",
+    "followers_count": 0,
+    "following_count": 3,
+    "starred_repos_count": 7,
+    "username": "quentin"
+  }
+}
diff --git a/example/forgejo.push.json b/example/forgejo.push.json
new file mode 100644
index 0000000..9270e79
--- /dev/null
+++ b/example/forgejo.push.json
@@ -0,0 +1,158 @@
+{
+  "ref": "refs/tags/0.9.0-rc.1",
+  "before": "0000000000000000000000000000000000000000",
+  "after": "e681ec50dc298db4fc3f6eb87f12f97afadb3210",
+  "compare_url": "https://git.deuxfleurs.fr/Deuxfleurs/albatros/compare/0000000000000000000000000000000000000000...e681ec50dc298db4fc3f6eb87f12f97afadb3210",
+  "commits": [],
+  "total_commits": 0,
+  "head_commit": {
+    "id": "8ac922d28311b51adb0c6d9574c52a1f05585b43",
+    "message": "push to dxflrs instead of superboum\n",
+    "url": "https://git.deuxfleurs.fr/Deuxfleurs/albatros/commit/8ac922d28311b51adb0c6d9574c52a1f05585b43",
+    "author": {
+      "name": "Quentin Dufour",
+      "email": "quentin@deuxfleurs.fr",
+      "username": "quentin"
+    },
+    "committer": {
+      "name": "Quentin Dufour",
+      "email": "quentin@deuxfleurs.fr",
+      "username": "quentin"
+    },
+    "verification": null,
+    "timestamp": "2023-05-04T16:15:12+02:00",
+    "added": [],
+    "removed": [],
+    "modified": [
+      "flake.nix"
+    ]
+  },
+  "repository": {
+    "id": 270,
+    "owner": {
+      "id": 3,
+      "login": "Deuxfleurs",
+      "login_name": "",
+      "full_name": "",
+      "email": "",
+      "avatar_url": "https://git.deuxfleurs.fr/avatars/9f7f0ddf4e41327d9b02aff0a559ea0b",
+      "language": "",
+      "is_admin": false,
+      "last_login": "0001-01-01T00:00:00Z",
+      "created": "2020-01-28T19:09:02Z",
+      "restricted": false,
+      "active": false,
+      "prohibit_login": false,
+      "location": "Rennes, France",
+      "website": "https://deuxfleurs.fr",
+      "description": "",
+      "visibility": "public",
+      "followers_count": 0,
+      "following_count": 0,
+      "starred_repos_count": 0,
+      "username": "Deuxfleurs"
+    },
+    "name": "albatros",
+    "full_name": "Deuxfleurs/albatros",
+    "description": "Tools to build a software supply chain on your own",
+    "empty": false,
+    "private": false,
+    "fork": false,
+    "template": false,
+    "parent": null,
+    "mirror": false,
+    "size": 798,
+    "language": "",
+    "languages_url": "https://git.deuxfleurs.fr/api/v1/repos/Deuxfleurs/albatros/languages",
+    "html_url": "https://git.deuxfleurs.fr/Deuxfleurs/albatros",
+    "link": "",
+    "ssh_url": "git@git.deuxfleurs.fr:Deuxfleurs/albatros.git",
+    "clone_url": "https://git.deuxfleurs.fr/Deuxfleurs/albatros.git",
+    "original_url": "",
+    "website": "",
+    "stars_count": 0,
+    "forks_count": 0,
+    "watchers_count": 9,
+    "open_issues_count": 5,
+    "open_pr_counter": 0,
+    "release_counter": 0,
+    "default_branch": "main",
+    "archived": false,
+    "created_at": "2023-03-14T17:52:11Z",
+    "updated_at": "2023-05-04T14:15:25Z",
+    "permissions": {
+      "admin": true,
+      "push": true,
+      "pull": true
+    },
+    "has_issues": true,
+    "internal_tracker": {
+      "enable_time_tracker": true,
+      "allow_only_contributors_to_track_time": true,
+      "enable_issue_dependencies": true
+    },
+    "has_wiki": true,
+    "has_pull_requests": true,
+    "has_projects": true,
+    "ignore_whitespace_conflicts": false,
+    "allow_merge_commits": true,
+    "allow_rebase": true,
+    "allow_rebase_explicit": true,
+    "allow_squash_merge": true,
+    "allow_rebase_update": true,
+    "default_delete_branch_after_merge": false,
+    "default_merge_style": "merge",
+    "default_allow_maintainer_edit": false,
+    "avatar_url": "",
+    "internal": false,
+    "mirror_interval": "",
+    "mirror_updated": "0001-01-01T00:00:00Z",
+    "repo_transfer": null
+  },
+  "pusher": {
+    "id": 4,
+    "login": "quentin",
+    "login_name": "",
+    "full_name": "Quentin",
+    "email": "quentin@dufour.io",
+    "avatar_url": "https://git.deuxfleurs.fr/avatars/b081d05777a68620eb6e3ca16a753b6a",
+    "language": "",
+    "is_admin": false,
+    "last_login": "0001-01-01T00:00:00Z",
+    "created": "2020-01-29T06:55:51Z",
+    "restricted": false,
+    "active": false,
+    "prohibit_login": false,
+    "location": "",
+    "website": "https://quentin.dufour.io",
+    "description": "",
+    "visibility": "public",
+    "followers_count": 0,
+    "following_count": 3,
+    "starred_repos_count": 7,
+    "username": "quentin"
+  },
+  "sender": {
+    "id": 4,
+    "login": "quentin",
+    "login_name": "",
+    "full_name": "Quentin",
+    "email": "quentin@dufour.io",
+    "avatar_url": "https://git.deuxfleurs.fr/avatars/b081d05777a68620eb6e3ca16a753b6a",
+    "language": "",
+    "is_admin": false,
+    "last_login": "0001-01-01T00:00:00Z",
+    "created": "2020-01-29T06:55:51Z",
+    "restricted": false,
+    "active": false,
+    "prohibit_login": false,
+    "location": "",
+    "website": "https://quentin.dufour.io",
+    "description": "",
+    "visibility": "public",
+    "followers_count": 0,
+    "following_count": 3,
+    "starred_repos_count": 7,
+    "username": "quentin"
+  }
+
diff --git a/hcl/nixcache/builder.hcl b/hcl/nixcache/builder.hcl
index 9d541a0..eb849c9 100644
--- a/hcl/nixcache/builder.hcl
+++ b/hcl/nixcache/builder.hcl
@@ -7,7 +7,7 @@ job "builder" {
 
   parameterized {
     payload = "optional"
-    meta_required = [ "REPO_URL", "COMMIT", "BRANCH", "FLAVOR" ]
+    meta_required = [ "REPO_URL", "COMMIT", "BRANCH", "TAG", "FLAVOR" ]
   }
 
   reschedule {
@@ -23,7 +23,7 @@ job "builder" {
   task "warmup-cache" {
     driver = "docker"
     config {
-      image = "nixpkgs/nix:nixos-22.11"
+      image = "nixpkgs/nix@sha256:fca3bf99804141e369bb52f35030f7c6c69e72b7d1ae3a9edf8ebeae2398f789"
       args = [ "/tmp/warmup.sh" ]
       volumes = [ 
         "local/warmup.sh:/tmp/warmup.sh",
@@ -47,7 +47,7 @@ job "builder" {
     driver = "docker"
     leader = true
     config {
-      image = "nixpkgs/nix:nixos-22.11"
+      image = "nixpkgs/nix@sha256:fca3bf99804141e369bb52f35030f7c6c69e72b7d1ae3a9edf8ebeae2398f789"
       args = [ "/tmp/builder.sh" ]
       volumes = [ 
         "local/builder.sh:/tmp/builder.sh",
@@ -65,6 +65,7 @@ job "builder" {
     env {
       COMMIT = "${NOMAD_META_COMMIT}"
       BRANCH = "${NOMAD_META_BRANCH}"
+      TAG = "${NOMAD_META_TAG}"
       REPO_URL = "${NOMAD_META_REPO_URL}"
       FLAVOR = "${NOMAD_META_FLAVOR}"
       GCROOT = "/mnt/cacheroot/${NOMAD_META_COMMIT}"
@@ -96,7 +97,7 @@ job "builder" {
   task "daemon" {
     driver = "docker"
     config {
-      image = "nixpkgs/nix:nixos-22.11"
+      image = "nixpkgs/nix@sha256:fca3bf99804141e369bb52f35030f7c6c69e72b7d1ae3a9edf8ebeae2398f789"
       command = "nix-daemon"
       volumes = [ 
         "/var/cache/albatros/nix:/nix",
@@ -128,7 +129,7 @@ job "builder" {
   task "garbage-collect-cache" {
     driver = "docker"
     config {
-      image = "nixpkgs/nix:nixos-22.11"
+      image = "nixpkgs/nix@sha256:fca3bf99804141e369bb52f35030f7c6c69e72b7d1ae3a9edf8ebeae2398f789"
       args = [ "/tmp/gc.sh" ]
       volumes = [ 
         "local/gc.sh:/tmp/gc.sh",
diff --git a/hcl/nixcache/user.sh b/hcl/nixcache/user.sh
index 20de347..fe13134 100644
--- a/hcl/nixcache/user.sh
+++ b/hcl/nixcache/user.sh
@@ -7,9 +7,11 @@ cd /workspace
 git init 
 git remote add origin ${NOMAD_META_REPO_URL}
 git fetch origin ${NOMAD_META_COMMIT}
-git checkout ${NOMAD_META_COMMIT} -b ${NOMAD_META_BRANCH}
+git checkout ${NOMAD_META_COMMIT} -b ${NOMAD_META_BRANCH:-$NOMAD_META_TAG}
 if [[ -s /var/run/secrets/albatros/secret.txt ]]; then
-  export SECRET_PATH=/var/run/secrets/albatros/secret.txt
+  set +x
+  source /var/run/secrets/albatros/secret.txt
+  set -x
 fi
 
 # wait for nix daemon during 120 seconds
diff --git a/pkg/handler.go b/pkg/handler.go
index 4795ba9..66827c0 100644
--- a/pkg/handler.go
+++ b/pkg/handler.go
@@ -76,13 +76,24 @@ func (h HookHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	var branch, tag string
+	// BRANCH OR TAG?
+	if strings.HasPrefix(notification.Ref, "refs/heads/") {
+		branch = strings.ReplaceAll(notification.Ref, "refs/heads/", "")
+	} else if strings.HasPrefix(notification.Ref, "refs/tags/") {
+		tag = strings.ReplaceAll(notification.Ref, "refs/tags/", "")
+	} else {
+		http.Error(w, fmt.Sprintf("ref '%s' is not a tag or a branch ref, albatros does not know what to do."), http.StatusBadRequest)
+		return
+	}
+
 	// Build job parameters for Nomad
 	meta := map[string]string{
 		"REPO_URL": notification.Repository.CloneUrl,
 		"COMMIT":   notification.After,
 		"FLAVOR":   flavor,
-		// @FIXME: this code is not correct, this is a hack
-		"BRANCH": strings.ReplaceAll(notification.Ref, "refs/heads/", ""),
+		"BRANCH":   branch,
+		"TAG":      tag,
 	}
 
 	// Check sender