diff --git a/ci/pipelines/publisher.yml b/ci/pipelines/publisher.yml
index 434c2b487c..943ffae40c 100644
--- a/ci/pipelines/publisher.yml
+++ b/ci/pipelines/publisher.yml
@@ -467,81 +467,100 @@ jobs:
       KERNEL_PACKAGE: linux-generic
     input_mapping:
       candidate-stemcell: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
-  - task: extract-warden-image
-    image: bosh-integration-registry-image
-    config:
-      inputs:
-        - name: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
-      outputs:
-        - name: stemcell-image
-      platform: linux
-      run:
-        dir: stemcell-image
-        path: /bin/bash
-        args:
-          - -ce
-          - tar xvf ../candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/bosh-stemcell-*-warden-boshlite-(@= data.values.stemcell_details.os_name @)*.tgz image
-  - put: github-container-registry-(@= data.values.stemcell_details.os_name @)-stemcell
-    params:
-      import_file: stemcell-image/image
-      tag_file: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/.resource/version
-      tag_as_latest: true
-  - put: published-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
-    params:
-      files:
-      - candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/*.tgz
-      options:
-        author_email: *ci_bot_email
-        author_name: *ci_bot_name
-        message: 'publish (heavy): (@= data.values.stemcell_details.os_name @)/(@= str(data.values.stemcell_details.major_version) @).x'
-      rename: '{{.Version}}/stemcells.meta4'
-      version: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/.resource/version
-  #@ if len(data.values.stemcell_details.include_fips_iaas) > 0 :
-  - put: published-(@= data.values.stemcell_details.os_name @)-fips-stemcell-(@= str(data.values.stemcell_details.major_version) @)
-    params:
-      files:
-      - candidate-(@= data.values.stemcell_details.os_name @)-fips-stemcell-(@= str(data.values.stemcell_details.major_version) @)/*.tgz
-      options:
-        author_email: *ci_bot_email
-        author_name: *ci_bot_name
-        message: 'publish (heavy): (@= data.values.stemcell_details.os_name @)-fips/(@= str(data.values.stemcell_details.major_version) @).x'
-      rename: '{{.Version}}/stemcells.meta4'
-      version: candidate-(@= data.values.stemcell_details.os_name @)-fips-stemcell-(@= str(data.values.stemcell_details.major_version) @)/.resource/version
-  #@ end
-  - params:
-      files:
-      - candidate-aws-light-stemcell/*.tgz
-      options:
-        author_email: *ci_bot_email
-        author_name: *ci_bot_name
-        message: 'publish (light aws): (@= data.values.stemcell_details.os_name @)/(@= str(data.values.stemcell_details.major_version) @).x'
-      rename: '{{.Version}}/stemcells.aws.meta4'
-      version: candidate-aws-light-stemcell/.resource/version
-    put: published-aws-light-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
-
-  #! once we release all regions with the same account, we can unify these again
-  - file: bosh-stemcells-ci/ci/tasks/light-aws/tag-aws-ami-light.yml
-    image: bosh-ecosystem-concourse-registry-image
-    task: tag-published-aws-ami-light-stemcells
-    params:
-      AWS_PAGER:
-      AWS_ACCESS_KEY_ID: ((aws_publish_us_access_key))
-      AWS_SECRET_ACCESS_KEY: ((aws_publish_us_secret_key))
-      GREP_PATTERN: grep -v 'gov-\|cn-'
-  - file: bosh-stemcells-ci/ci/tasks/light-aws/tag-aws-ami-light.yml
-    image: bosh-ecosystem-concourse-registry-image
-    task: tag-gov-published-aws-ami-light-stemcells
-    params:
-      AWS_PAGER:
-      AWS_ACCESS_KEY_ID: ((aws_publish_us-gov_access_key))
-      AWS_SECRET_ACCESS_KEY: ((aws_publish_us-gov_secret_key))
-      GREP_PATTERN: grep 'gov-'
-#!  - file: bosh-stemcells-ci/ci/tasks/light-aws/tag-aws-ami-light.yml
-#!    task: tag-china-published-aws-ami-light-stemcells
-#!    params:
-#!      AWS_ACCESS_KEY_ID: ((aws_publish_cn_access_key))
-#!      AWS_SECRET_ACCESS_KEY: ((aws_publish_cn_secret_key))
-#!      GREP_PATTERN: grep 'cn-'
+  - in_parallel:
+    - in_parallel:
+      - task: extract-warden-image
+        image: bosh-integration-registry-image
+        config:
+          inputs:
+            - name: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
+          outputs:
+            - name: stemcell-image
+          platform: linux
+          run:
+            dir: stemcell-image
+            path: /bin/bash
+            args:
+              - -ce
+              - |
+                tar xvf ../candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/bosh-stemcell-*-warden-boshlite-(@= data.values.stemcell_details.os_name @)*.tgz image
+                printf 'FROM scratch\nADD image /\n' > Dockerfile
+      - task: build-stemcell-oci-image
+        privileged: true
+        config:
+          platform: linux
+          image_resource:
+            type: registry-image
+            source:
+              repository: concourse/oci-build-task
+          inputs:
+            - name: stemcell-image
+          outputs:
+            - name: image
+          params:
+            CONTEXT: stemcell-image
+          run:
+            path: build
+      - put: github-container-registry-(@= data.values.stemcell_details.os_name @)-stemcell
+        params:
+          image: image/image.tar
+          additional_tags: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/.resource/version
+    - put: published-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
+      params:
+        files:
+        - candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/*.tgz
+        options:
+          author_email: *ci_bot_email
+          author_name: *ci_bot_name
+          message: 'publish (heavy): (@= data.values.stemcell_details.os_name @)/(@= str(data.values.stemcell_details.major_version) @).x'
+        rename: '{{.Version}}/stemcells.meta4'
+        version: candidate-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/.resource/version
+    #@ if len(data.values.stemcell_details.include_fips_iaas) > 0 :
+    - put: published-(@= data.values.stemcell_details.os_name @)-fips-stemcell-(@= str(data.values.stemcell_details.major_version) @)
+      params:
+        files:
+        - candidate-(@= data.values.stemcell_details.os_name @)-fips-stemcell-(@= str(data.values.stemcell_details.major_version) @)/*.tgz
+        options:
+          author_email: *ci_bot_email
+          author_name: *ci_bot_name
+          message: 'publish (heavy): (@= data.values.stemcell_details.os_name @)-fips/(@= str(data.values.stemcell_details.major_version) @).x'
+        rename: '{{.Version}}/stemcells.meta4'
+        version: candidate-(@= data.values.stemcell_details.os_name @)-fips-stemcell-(@= str(data.values.stemcell_details.major_version) @)/.resource/version
+    #@ end
+    - params:
+        files:
+        - candidate-aws-light-stemcell/*.tgz
+        options:
+          author_email: *ci_bot_email
+          author_name: *ci_bot_name
+          message: 'publish (light aws): (@= data.values.stemcell_details.os_name @)/(@= str(data.values.stemcell_details.major_version) @).x'
+        rename: '{{.Version}}/stemcells.aws.meta4'
+        version: candidate-aws-light-stemcell/.resource/version
+      put: published-aws-light-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)
+
+    #! once we release all regions with the same account, we can unify these again
+    - file: bosh-stemcells-ci/ci/tasks/light-aws/tag-aws-ami-light.yml
+      image: bosh-ecosystem-concourse-registry-image
+      task: tag-published-aws-ami-light-stemcells
+      params:
+        AWS_PAGER:
+        AWS_ACCESS_KEY_ID: ((aws_publish_us_access_key))
+        AWS_SECRET_ACCESS_KEY: ((aws_publish_us_secret_key))
+        GREP_PATTERN: grep -v 'gov-\|cn-'
+    - file: bosh-stemcells-ci/ci/tasks/light-aws/tag-aws-ami-light.yml
+      image: bosh-ecosystem-concourse-registry-image
+      task: tag-gov-published-aws-ami-light-stemcells
+      params:
+        AWS_PAGER:
+        AWS_ACCESS_KEY_ID: ((aws_publish_us-gov_access_key))
+        AWS_SECRET_ACCESS_KEY: ((aws_publish_us-gov_secret_key))
+        GREP_PATTERN: grep 'gov-'
+#!    - file: bosh-stemcells-ci/ci/tasks/light-aws/tag-aws-ami-light.yml
+#!      task: tag-china-published-aws-ami-light-stemcells
+#!      params:
+#!        AWS_ACCESS_KEY_ID: ((aws_publish_cn_access_key))
+#!        AWS_SECRET_ACCESS_KEY: ((aws_publish_cn_secret_key))
+#!        GREP_PATTERN: grep 'cn-'
   - params:
       files:
       - candidate-google-light-(@= data.values.stemcell_details.os_name @)-stemcell-(@= str(data.values.stemcell_details.major_version) @)/*.tgz
@@ -838,11 +857,12 @@ resources:
   #@ end
 
 - name: github-container-registry-(@= data.values.stemcell_details.os_name @)-stemcell
-  type: docker-image
+  type: registry-image
   source:
     repository: ghcr.io/cloudfoundry/(@= data.values.stemcell_details.os_name @)-stemcell
     username: ((github_read_write_packages.username))
     password: ((github_read_write_packages.password))
+    tag: latest
 
 - name: bosh-integration-registry-image
   type: registry-image