diff --git a/Makefile b/Makefile
index 20c4d83..f2967a5 100644
--- a/Makefile
+++ b/Makefile
@@ -9,7 +9,11 @@ DOCKER_TAG = ${DOCKER_TAG_VERSION}-${DOCKER_TAG_ARCH_SUFFIX}
 .PHONY: docker-build docker-push
 
 docker-build:
+	git diff --exit-code
+	git diff --staged --exit-code
 	sudo docker build -t "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}" .
 
 docker-push: docker-build
 	sudo docker push "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}"
+	sleep 2 # wait for repo digest
+	@echo git tag --sign --message '$(shell sudo docker image inspect --format '{{join .RepoDigests "\n"}}' "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}")' docker/${DOCKER_TAG} $(shell git rev-parse HEAD)