diff --git a/.woodpecker/docker.yaml b/.woodpecker/docker.yaml
index 463f4b4..5f33e68 100644
--- a/.woodpecker/docker.yaml
+++ b/.woodpecker/docker.yaml
@@ -36,12 +36,11 @@ steps:
             memory: 4Gi
             cpu: 2
 
-  # The default distro's unsuffixed tags are aliases of the image the step above just
-  # pushed, not a second build of it: imagetools create only writes new tag references
-  # to the existing manifest, so :<version>, :latest and :<version>-<suffix> are one
-  # digest. No daemon is involved; the internal CA is baked into this image at
-  # /etc/docker/certs.d/.
-  - name: docker-default-tags
+  # The default distro's unsuffixed tag is an alias of the image the step above just
+  # pushed, not a second build of it: imagetools create only writes a new tag reference
+  # to the existing manifest, so :<version> and :<version>-<suffix> are one digest. No
+  # daemon is involved; the internal CA is baked into this image at /etc/docker/certs.d/.
+  - name: docker-default-tag
     image: "artifactapi.k8s.syd1.au.unkin.net/docker-internal/plugin-docker-buildx:latest"
     when:
       - evaluate: 'DEFAULT == "true"'
@@ -50,7 +49,7 @@ steps:
       VERSION: "${CI_COMMIT_TAG##v}"
       SUFFIX: "${TAG_SUFFIX}"
     commands:
-      - 'docker buildx imagetools create -t "$REPO:$VERSION" -t "$REPO:latest" "$REPO:$VERSION-$SUFFIX"'
+      - 'docker buildx imagetools create -t "$REPO:$VERSION" "$REPO:$VERSION-$SUFFIX"'
     backend_options:
       kubernetes:
         serviceAccountName: default
diff --git a/README.md b/README.md
index 62355e6..62d30dc 100644
--- a/README.md
+++ b/README.md
@@ -2,8 +2,8 @@
 
 The estate's Go toolchain image, built on each `container-base` distro image.
 Published as `artifactapi.k8s.syd1.au.unkin.net/docker-internal/gobuilder:<version>-<suffix>`;
-the default distro's build is retagged as the unsuffixed `:<version>` and `:latest`,
-so all three resolve to one digest.
+the default distro's build is retagged as the unsuffixed `:<version>`, so both resolve
+to one digest. No `:latest` — nothing in the estate floats.
 
 | distro | from | tag suffix | default |
 | --- | --- | --- | --- |
diff --git a/ci/check-distros.sh b/ci/check-distros.sh
index 6948081..8658c7e 100755
--- a/ci/check-distros.sh
+++ b/ci/check-distros.sh
@@ -36,7 +36,7 @@ EOF
   done
 done
 
-# Exactly one distro owns the unsuffixed :<version> and :latest tags.
+# Exactly one distro owns the unsuffixed :<version> tag.
 defaults=$(grep -l 'DEFAULT="true"' distros/*/distro.env | wc -l)
 [ "$defaults" -eq 1 ] || { echo "expected exactly one distro with DEFAULT=\"true\", found ${defaults}"; fail=1; }
 
diff --git a/distros/alma9/distro.env b/distros/alma9/distro.env
index 62fd458..0f0e88c 100644
--- a/distros/alma9/distro.env
+++ b/distros/alma9/distro.env
@@ -2,7 +2,7 @@
 BASE_IMAGE_NAME="almalinux9"
 IMAGE="gobuilder"
 TAG_SUFFIX="alma9"
-# The default distro also gets the unsuffixed :<version> and :latest tags.
+# The default distro also gets the unsuffixed :<version> tag.
 DEFAULT="true"
 
 # Estate local repo used to prove inherited HTTPS trust.