diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 3a82a01..5d76084 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -35,6 +35,7 @@ jobs:
     with:
       bundle-name: ghcr.io/datum-cloud/vpc-controller-kustomize
       bundle-path: config
-      image-name: ghcr.io/datum-cloud/vpc-controller
-      image-overlays: config/manager
+      images: |
+        - { path: config/manager, name: ghcr.io/datum-cloud/vpc-controller }
+        - { path: config/fabric-identity, name: ghcr.io/datum-cloud/vpc-controller }
     secrets: inherit
diff --git a/config/fabric-identity/kustomization.yaml b/config/fabric-identity/kustomization.yaml
index a69dd5a..27c749d 100644
--- a/config/fabric-identity/kustomization.yaml
+++ b/config/fabric-identity/kustomization.yaml
@@ -28,3 +28,12 @@ resources:
   - ../rbac
 components:
   - ../components/fabric-identity
+
+# Pinned here rather than inherited from ../manager: this overlay does not
+# include it, and the publish workflow rewrites the tag in every overlay it is
+# given. Without a block of its own the deployment ships whatever the component
+# names, which is a tag the workflow never publishes.
+images:
+  - name: ghcr.io/datum-cloud/vpc-controller
+    newName: ghcr.io/datum-cloud/vpc-controller
+    newTag: latest