diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52e5270..8272f73 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,8 @@ jobs:
     outputs:
       api_release: ${{ steps.api.outputs.release }}
       api_version: ${{ steps.api.outputs.version }}
+      api_release_channel: ${{ steps.api.outputs.channel }}
+      api_latest: ${{ steps.api.outputs.latest }}
     steps:
       - name: Check out code
         uses: actions/checkout@v2
@@ -36,6 +38,17 @@ jobs:
           API_VERSION=$(cat pyproject.toml | grep '^version' | awk '{print$3}' | sed 's/"//g')
           echo "version=$API_VERSION" >> "$GITHUB_OUTPUT"
 
+          # Choose between "unstable" and "stable" channels.
+          # We choose "unstable" when the version contains a hyphen (e.g., 0.1.0-alpha).
+          # TODO(jnu): "latest" is an alias for "stable" right now.
+          # It's deprecated and should be replaced with "stable" in the future.
+          if [[ $API_VERSION == *"-"* ]]; then
+            echo "channel=unstable" >> "$GITHUB_OUTPUT"
+          else
+            echo "channel=stable" >> "$GITHUB_OUTPUT"
+            echo "latest=true" >> "$GITHUB_OUTPUT"
+          fi
+
           if git rev-parse "api-$API_VERSION" >/dev/null 2>&1; then
             echo "Tag api-$API_VERSION already exists"
             echo "release=false" >> "$GITHUB_OUTPUT"
@@ -124,9 +137,11 @@ jobs:
           # Override default context to use the checkout with Dockerfile modifications.
           context: ${{github.workspace}}
           file: ${{github.workspace}}/Dockerfile
-          # Apply new version tag and replace any existing `latest` tag.
+          # Apply new version tag, as well as a tag based on release channel.
+          # TODO(jnu): "latest" is an alias for "stable" right now, but it's deprecated
+          # and will be removed in the future.
           push: true
-          tags: blindchargingapi.azurecr.io/blind-charging-api:latest,blindchargingapi.azurecr.io/blind-charging-api:${{ needs.tag.outputs.api_version }}
+          tags: blindchargingapi.azurecr.io/blind-charging-api:${{ needs.tag.outputs.api_release_channel }},blindchargingapi.azurecr.io/blind-charging-api:${{ needs.tag.outputs.api_version }}${{ needs.tag.outputs.api_latest == 'true' && ',blindchargingapi.azurecr.io/blind-charging-api:latest' || '' }}
 
   # Create GitHub release with notes
   release:
@@ -145,8 +160,8 @@ jobs:
         with:
           name: v${{ needs.tag.outputs.api_version }}
           tag_name: api-${{ needs.tag.outputs.api_version }}
-          prerelease: false
-          make_latest: true
+          prerelease: ${{ needs.tag.outputs.api_release_channel == 'unstable' }}
+          make_latest: ${{ needs.tag.outputs.api_release_channel == 'stable' }}
           generate_release_notes: true
 
       - name: Post Slack message
diff --git a/terraform/vars.tf b/terraform/vars.tf
index 84a4f58..2487588 100644
--- a/terraform/vars.tf
+++ b/terraform/vars.tf
@@ -212,13 +212,13 @@ variable "api_image" {
 
 variable "api_image_version" {
   type        = string
-  default     = "latest"
+  default     = "stable"
   description = <<EOF
 The version of the Docker image used to run the API.
 
 This version must exist in the repo specified in `var.api_image`.
 
-**WARNING** If the tag is `latest` (the default!), the image version may upgrade
+**WARNING** If the tag is `stable` (the default!), the image version may upgrade
 unexpectedly when the app containers restart. This is usually fine, but it's
 recommended to lock the version and increment it manually in case a new image
 contains incompatible changes.