diff --git a/.github/workflows/radius-build.yml b/.github/workflows/radius-build.yml
index 8148b34fc..0899a1166 100644
--- a/.github/workflows/radius-build.yml
+++ b/.github/workflows/radius-build.yml
@@ -22,6 +22,8 @@ env:
   GHCR_ACTOR: rad-ci-bot
   # Container registry url for GitHub container registry.
   CONTAINER_REGISTRY: ${{ github.event_name == 'push' && 'ghcr.io/radius-project/dev' || 'ghcr.io/radius-project/radius' }}
+  # URL to get source code for building the image
+  IMAGE_SRC: https://github.com/radius-project/radius
 
 jobs:
   build:
@@ -250,9 +252,9 @@ jobs:
             --title "Radius Bicep v${{ env.REL_VERSION }}"
         env:
           GITHUB_TOKEN: ${{ secrets.GH_RAD_CI_BOT_PAT }}
-  
+          
+  # TODO once tested: if: ${{ github.event_name == 'push' }}
   publish_ghcr:
-    if: ${{ github.event_name == 'push' }}
     name: Publish to GHCR
     needs: ["build", "vscode-bicep-build"]
     runs-on: ubuntu-latest
@@ -304,7 +306,7 @@ jobs:
       - run: oras version
       - name: Push rad bicep binaries to GHCR (${{ matrix.runtime.name }})
         run: |
-          oras push ${{ env.CONTAINER_REGISTRY }}/bicep/rad-bicep/${{ matrix.runtime.name }}:latest ./artifacts/bicep/${{ matrix.runtime.name }}/
+          oras push --annotation "org.opencontainers.image.source=${{ env.IMAGE_SRC }}" ${{ env.CONTAINER_REGISTRY }}/bicep/rad-bicep/${{ matrix.runtime.name }}:latest ./artifacts/bicep/${{ matrix.runtime.name }}/
       - name: Check uploaded
         run: curl --fail ${{ env.CONTAINER_REGISTRY }}/bicep/rad-bicep/${{ matrix.runtime.name }}:latest -v > out