diff --git a/.github/workflows/build-bundle.yml b/.github/workflows/build-bundle.yml
index 3ab7900134..0a89393967 100644
--- a/.github/workflows/build-bundle.yml
+++ b/.github/workflows/build-bundle.yml
@@ -29,6 +29,7 @@ jobs:
     timeout-minutes: 10
     outputs:
       gh_ref: ${{ steps.vars.outputs.gh_ref }}
+      ref_slug: ${{ steps.vars.outputs.ref_slug }}
       bundle_version: ${{ steps.vars.outputs.bundle_version }}
       exists: ${{ steps.check.outputs.exists }}
 
@@ -41,9 +42,16 @@ jobs:
 
       - name: Extract some useful variables
         id: vars
+        env:
+          GH_REF: ${{ inputs.gh_ref || github.ref_name }}
         run: |
-          echo "gh_ref=${{ inputs.gh_ref || github.ref_name }}" >> $GITHUB_OUTPUT
-          echo "bundle_version=$(git describe --tags --always)" >> $GITHUB_OUTPUT
+          # A git ref accepts characters that an S3 key and a Docker tag do not.
+          REF_SLUG=$(printf '%s' "$GH_REF" | tr -c 'A-Za-z0-9._-' '-' | cut -c1-100)
+          {
+            echo "gh_ref=$GH_REF"
+            echo "ref_slug=$REF_SLUG"
+            echo "bundle_version=$(git describe --tags --always)"
+          } >> "$GITHUB_OUTPUT"
 
       # The uploaded zip carries its version as S3 metadata. If the
       # existing object was already built from this same commit, the
@@ -57,7 +65,7 @@ jobs:
         run: |
           EXISTING_VERSION=$(aws s3api head-object \
             --bucket ${{ secrets.S3_BUCKET }} \
-            --key "penpot-${{ steps.vars.outputs.gh_ref }}.zip" \
+            --key "penpot-${{ steps.vars.outputs.ref_slug }}.zip" \
             --query 'Metadata."bundle-version"' \
             --output text 2>/dev/null || echo "none")
 
@@ -110,7 +118,7 @@ jobs:
           AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
         run: |
           aws s3 cp zips/penpot.zip \
-            s3://${{ secrets.S3_BUCKET }}/penpot-${{ needs.check.outputs.gh_ref }}.zip \
+            s3://${{ secrets.S3_BUCKET }}/penpot-${{ needs.check.outputs.ref_slug }}.zip \
             --metadata bundle-version=${{ needs.check.outputs.bundle_version }}
 
   # ── 3. Single failure notification for the whole workflow ─────────────
diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
index 6fffaa4acd..967ce807c8 100644
--- a/.github/workflows/build-docker.yml
+++ b/.github/workflows/build-docker.yml
@@ -36,6 +36,7 @@ jobs:
     timeout-minutes: 15
     outputs:
       gh_ref: ${{ steps.vars.outputs.gh_ref }}
+      ref_slug: ${{ steps.vars.outputs.ref_slug }}
       bundle_version: ${{ steps.vars.outputs.bundle_version }}
       build_key: ${{ steps.vars.outputs.build_key }}
       exists: ${{ steps.check.outputs.exists }}
@@ -54,11 +55,14 @@ jobs:
           AWS_DEFAULT_REGION: ${{ secrets.AWS_REGION }}
         run: |
           GH_REF="${{ inputs.gh_ref || github.ref_name }}"
+          # A git ref accepts characters that an S3 key and a Docker tag do not.
+          REF_SLUG=$(printf '%s' "$GH_REF" | tr -c 'A-Za-z0-9._-' '-' | cut -c1-100)
           echo "gh_ref=$GH_REF" >> $GITHUB_OUTPUT
+          echo "ref_slug=$REF_SLUG" >> $GITHUB_OUTPUT
 
           BUNDLE_VERSION=$(aws s3api head-object \
             --bucket ${{ secrets.S3_BUCKET }} \
-            --key "penpot-$GH_REF.zip" \
+            --key "penpot-$REF_SLUG.zip" \
             --query 'Metadata."bundle-version"' \
             --output text)
           echo "bundle_version=$BUNDLE_VERSION" >> $GITHUB_OUTPUT
@@ -99,7 +103,7 @@ jobs:
             find "$BUNDLE_CACHE" -type f -mtime +1 -delete || true
             ZIP="$BUNDLE_CACHE/penpot-${{ steps.vars.outputs.build_key }}.zip"
             if [ ! -f "$ZIP" ]; then
-              aws s3 cp "s3://${{ secrets.S3_BUCKET }}/penpot-${{ steps.vars.outputs.gh_ref }}.zip" "$ZIP.$$.tmp"
+              aws s3 cp "s3://${{ secrets.S3_BUCKET }}/penpot-${{ steps.vars.outputs.ref_slug }}.zip" "$ZIP.$$.tmp"
               mv "$ZIP.$$.tmp" "$ZIP"
             fi
           fi
@@ -173,7 +177,7 @@ jobs:
           if [ ! -f "$ZIP" ]; then
             echo "Bundle not found in host cache; falling back to S3."
             mkdir -p "$BUNDLE_CACHE"
-            aws s3 cp "s3://${{ secrets.S3_BUCKET }}/penpot-${{ needs.prepare.outputs.gh_ref }}.zip" "$ZIP.$$.tmp"
+            aws s3 cp "s3://${{ secrets.S3_BUCKET }}/penpot-${{ needs.prepare.outputs.ref_slug }}.zip" "$ZIP.$$.tmp"
             mv "$ZIP.$$.tmp" "$ZIP"
           fi
           # Extract only the bundle this job needs.
@@ -244,7 +248,7 @@ jobs:
           set -e
           for image in $ALL_IMAGES; do
             docker buildx imagetools create \
-              -t "${{ secrets.DOCKER_REGISTRY }}/$image:${{ needs.prepare.outputs.gh_ref }}" \
+              -t "${{ secrets.DOCKER_REGISTRY }}/$image:${{ needs.prepare.outputs.ref_slug }}" \
               "${{ secrets.DOCKER_REGISTRY }}/$image:build-${{ needs.prepare.outputs.build_key }}"
           done
 
@@ -261,7 +265,7 @@ jobs:
           {
             echo "### ✅ Image set promoted"
             echo ""
-            echo "All \`:${{ needs.prepare.outputs.gh_ref }}\` tags now point to \`build-${{ needs.prepare.outputs.build_key }}\`."
+            echo "All \`:${{ needs.prepare.outputs.ref_slug }}\` tags now point to \`build-${{ needs.prepare.outputs.build_key }}\`."
           } >> "$GITHUB_STEP_SUMMARY"
 
   # ── 4. Single failure notification for the whole workflow ─────────────