diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1a96656..99e648f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -33,18 +33,17 @@ jobs:
           name: MySQL Test
           command: bash tests/test.sh
       - deploy:
-          environment:
-            REGISTRY: QUAY
           command: |
-            if [ "${CIRCLE_BRANCH}" == "master" ]; then
               python .travis/deploy.py
-            fi
 
 workflows:
   version: 2
-  test-workflow:
+  build-and-deploy-workflow:
     jobs:
-      - build
+      - build:
+          filters:
+            tags:
+              only: /^v\d+\.\d+\.\d+$/
 
   cron-workflow:
     triggers:
diff --git a/.travis/deploy.py b/.travis/deploy.py
index c2e1ed0..1a4f6ea 100644
--- a/.travis/deploy.py
+++ b/.travis/deploy.py
@@ -1,11 +1,39 @@
 #! /usr/bin/env python
 
+# Author: Abhilash Raj
+# 
+# This is the primary deployment script for the docker-mailman repo. It does
+# deployment for stable and rolling releases both. It should be *always* invoked
+# and it will make the deployment decision based on the environment variables
+# that it sees.
+#
+# There are two kinds of deploymnets primarily:
+# 1. Rolling tags, which are built from each commit. These are typically run 
+#    in CI every day as well. These always update the "rolling" tag in the
+#    docker registry.
+# 2. Stable tags, which are built from git tags with "va.b.c" tags. We don't
+#    do the tag verification because for now, Circle CI does this for us. We
+#    will tag and release a stable version whenever the right ENV var is set.
+#
+# Publishing:
+# We are typically publishing all the images to three repositories:
+# 1. Docker Hub: This is now rate-limited and might cause issues for people
+#    pulling too frequently.
+# 2. Quay: This is an old registry that we started publishing too, so let's
+#    continue publishing here too.
+# 3. Github Registry: This is the newest one in the mix and supports free
+#    uploads and downloads (without very strict rate limits like Dockerhub.)
+
 import os
 import subprocess
 
 #: Default user, which owns the repositories.
 USER = 'maxking'
 
+TAG_VAR = 'CIRCLE_TAG'
+BRANCH_VAR = 'CIRCLE_BRANCH'
+PRIMARY_BRANCH = 'master'
+
 
 def tag(original, final):
     """Tag the source image with final tag."""
@@ -53,11 +81,16 @@ def tag_and_push(image_names, url, img_tag):
     push(final)
 
 
-if __name__ == '__main__':
-
-    img_tag = 'rolling'
-
-    prev_failed = False
+def main():
+    """Primary entrypoint to this script."""
+    
+    if os.environ.get(TAG_VAR) not in (None, ''):
+        img_tag = os.environ.get(TAG_VAR)
+    elif os.environ.get(BRANCH_VAR) == PRIMARY_BRANCH:
+        img_tag = 'rolling'
+    else:
+        print(f'Not running on master branch or Git tag so not publishing...')
+        exit(0)
 
     for url in ('quay.io', 'docker.io', 'ghcr.io'):
 
@@ -73,6 +106,14 @@ if __name__ == '__main__':
         except subprocess.CalledProcessError:
             print('Failed to login to {}'.format(url))
             continue
+
         tag_and_push(core, url, img_tag)
         tag_and_push(web, url, img_tag)
         tag_and_push(postorius, url, img_tag)
+
+
+if __name__ == '__main__':
+
+    main()
+
+