diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml
index 184221d5f..dbe68b77d 100644
--- a/.azure-pipelines/publish-docker.yml
+++ b/.azure-pipelines/publish-docker.yml
@@ -1,5 +1,7 @@
 # Trigger: any `v*` release tag (e.g. v1.40.0).
-# Can also be queued manually from the ADO UI.
+# Can also be queued manually from the ADO UI. A manual 'stable' run is possible only
+# on a `release-*` branch: it publishes the images of the last release tag of that
+# branch again, from the tip of the branch.
 trigger:
   tags:
     include:
diff --git a/utils/docker/publish_docker.sh b/utils/docker/publish_docker.sh
index 62b352b04..289194b9b 100755
--- a/utils/docker/publish_docker.sh
+++ b/utils/docker/publish_docker.sh
@@ -16,6 +16,21 @@ if [[ "${RELEASE_CHANNEL}" != "stable" && "${RELEASE_CHANNEL}" != "canary" ]]; t
 fi
 
 PW_VERSION=$(python -c "from playwright._repo_version import version;print(version)")
+# A stable run on a release branch publishes the images of the last release of that
+# branch again, for example with a cherry-picked fix of the image. The commit has no
+# tag then, so setuptools-scm gives a dev version: use the version of the last tag,
+# also for the wheels that build.sh puts into the image.
+if [[ "${RELEASE_CHANNEL}" == "stable" && "${BUILD_SOURCEBRANCH:-}" =~ ^refs/heads/release-([0-9]+\.[0-9]+)$ ]]; then
+  BRANCH_VERSION="${BASH_REMATCH[1]}"
+  LAST_TAG=$(git describe --tags --abbrev=0 --match 'v[0-9]*')
+  if [[ ! "${LAST_TAG}" =~ ^v${BRANCH_VERSION//./\\.}\.[0-9]+$ ]]; then
+    echo "ERROR: the last tag '${LAST_TAG}' is not a release of ${BUILD_SOURCEBRANCH}"
+    exit 1
+  fi
+  PW_VERSION="${LAST_TAG#v}"
+  export SETUPTOOLS_SCM_PRETEND_VERSION="${PW_VERSION}"
+  echo "== STABLE build from ${BUILD_SOURCEBRANCH}: publishing as v${PW_VERSION} =="
+fi
 if [[ "${RELEASE_CHANNEL}" == "stable" && ! "${PW_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
   echo "ERROR: cannot publish stable docker with Playwright version '${PW_VERSION}'"
   exit 1