diff --git a/.github/workflows/normal.yaml b/.github/workflows/normal.yaml
index ee47b01..92ce904 100644
--- a/.github/workflows/normal.yaml
+++ b/.github/workflows/normal.yaml
@@ -174,7 +174,7 @@ jobs:
 
       - name: Create version tag (if release)
         run: |
-          just nix-develop-ci ./tools/ci/assert-tag.sh "$GITHUB_REF"
+          just nix-develop-ci ./tools/ci/assert-tag.sh create-and-check "$GITHUB_REF"
 
       - name: Build container image (nix)
         run: |
@@ -189,6 +189,10 @@ jobs:
 
       - name: Push tag (if release)
         run: |
-          just nix-develop-ci ./tools/ci/assert-tag.sh --push "$GITHUB_REF"
+          just nix-develop-ci ./tools/ci/assert-tag.sh push "$GITHUB_REF"
 
+      - name: Cleanup
+        if: always()
+        run: |
+          just nix-develop-ci tools/ci/assert-tag cleanup
     # TODO: on fail delete prepare tag
diff --git a/tools/ci/assert-tag.sh b/tools/ci/assert-tag.sh
index 1c2f480..a442dbd 100755
--- a/tools/ci/assert-tag.sh
+++ b/tools/ci/assert-tag.sh
@@ -21,11 +21,12 @@ function main() {
 
     if [ "$type" = "push" ]; then
         print_info "Pushing tag '$release_tag'."
+
         git push origin "$release_tag" ||
             die "Could not push tag."
 
-        exit 0
     elif [ "$type" = "create-and-check" ]; then
+
         print_info "Create tag '$release_tag' and check."
 
         # Gets the message on the annotated commit:
@@ -49,8 +50,16 @@ function main() {
             "$release_tag^..origin/$RELEASE_BRANCH")" ]; then
             die "Tag is not reachable from '$RELEASE_BRANCH' (--first-parent) !"
         fi
-    fi
 
+    elif [ "$type" = "cleanup" ]; then
+
+        print_info "Cleanup the prepare tag."
+        git tag -d "$prepare_tag" || true
+        git push origin :"$prepare_tag" || true
+
+    else
+        die "Type '$type' is not known."
+    fi
 }
 
 main "$@"
diff --git a/tools/release.sh b/tools/release.sh
index 0fad4d9..178962c 100755
--- a/tools/release.sh
+++ b/tools/release.sh
@@ -20,10 +20,20 @@ function delete_prepare_tags() {
     for tag in "${prepareTag[@]}"; do
         print_info "Deleting prepare tag '$tag'."
         git push -f origin ":${tag}" || true
-        git tag -d "$tag"
+        git tag -d "$tag" || die
     done
 }
 
+function create_prepare_tag() {
+    local tag="v$1"
+
+    print_info "Tagging with '$tag'."
+    git tag -a -m "Version $tag" "prepare-$tag" || die "Could not create tag."
+
+    print_info "Tag contains:"
+    git cat-file -p "prepare-$tag" || die "Could not show tag content."
+}
+
 function commit_version_file() {
     local version="$1"
     print_info "Writing new version file... (for Nix)"
@@ -37,16 +47,6 @@ function commit_version_file() {
     fi
 }
 
-function create_prepare_tag() {
-    tag="v$version"
-
-    print_info "Tagging..."
-    git tag -a -m "Version $tag" "prepare-$tag"
-
-    print_info "Tag contains:"
-    git cat-file -p "prepare-$tag"
-}
-
 function trigger_build() {
     local branch="$1"
     printf "Do you want to trigger the build? [y|n]: "
@@ -115,9 +115,8 @@ function main() {
     delete_prepare_tags
 
     check_new_version "$version"
-
     commit_version_file "$version"
-    create_prepare_tag
+    create_prepare_tag "$version"
 
     trigger_build "$branch"
 }