diff --git a/.github/actions/docker-init/action.yml b/.github/actions/docker-init/action.yml
index 92fb5a9a..64a52565 100644
--- a/.github/actions/docker-init/action.yml
+++ b/.github/actions/docker-init/action.yml
@@ -33,9 +33,12 @@ runs:
 
     - name: Determine Debian tag
       run: |
+        COMMIT_DATE=$(date -d @$(git log -1 --pretty=%ct) +%Y%m%d)
         DEBIAN_RELEASE=$(grep -m 1 'ARG DEBIAN_TAG=' Dockerfile | sed 's/.*DEBIAN_TAG=\(.*\)-.*/\1/')
-        echo "DEBIAN_TAG=$(podman image search --list-tags debian --limit 1000000000 | \
-                           grep "$DEBIAN_RELEASE-.*-slim" | sort -r | head -1 | sed 's/.*[ ]\+//')" >> $GITHUB_ENV
+        echo "DEBIAN_TAG=$(podman search --list-tags docker.io/debian --limit 1000000000 | \
+                           grep "$DEBIAN_RELEASE-.*-slim" | sort -r | sed 's/.*[ ]\+//' | \
+                           ./scripts/lower-bound.py $DEBIAN_RELEASE-$COMMIT_DATE-slim )" \
+                           >> $GITHUB_ENV
       shell: bash
 
     - name: Prepare repository for COPY-in
diff --git a/scripts/lower-bound.py b/scripts/lower-bound.py
new file mode 100755
index 00000000..a0cf3197
--- /dev/null
+++ b/scripts/lower-bound.py
@@ -0,0 +1,11 @@
+#!/usr/bin/env python3
+# takes a reverse-sorted, line separated list and
+# returns the first element that is equal or smaller
+# than the first argument
+
+import sys
+
+for line in sys.stdin:
+    if line.rstrip() <= sys.argv[1]:
+        print(line.rstrip())
+        break