diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 0f1cbea..b945795 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -37,9 +37,12 @@ jobs:
       uses: docker/metadata-action@v5
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        # Pre-releases (PEP 440 a/b/rc/dev, e.g. v1.4.1rc1) get only their
+        # own tag, never `latest`: prod pulls `latest` via Watchtower, so an
+        # RC must not roll out on its own. contains() is case-insensitive.
         tags: |
           type=ref,event=tag
-          type=raw,value=latest
+          type=raw,value=latest,enable=${{ !contains(github.ref_name, 'a') && !contains(github.ref_name, 'b') && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'dev') }}
 
     - name: Build and push Docker image
       id: build
diff --git a/pixelmap/__init__.py b/pixelmap/__init__.py
index 42aaeb3..0cc510f 100644
--- a/pixelmap/__init__.py
+++ b/pixelmap/__init__.py
@@ -7,6 +7,6 @@
 
 from .backend import *
 
-__version__ = "1.4.0"
+__version__ = "1.4.1rc1"
 __author__ = "Maxime Beau"
 __email__ = "maxime@princeton.edu"