diff --git a/release/README.md b/release/README.md
index f07357f97..d817ee18d 100644
--- a/release/README.md
+++ b/release/README.md
@@ -41,7 +41,6 @@ release for! The command examples assume that you have a git remote called
 - Please check https://hub.docker.com/r/mitmproxy/mitmproxy/tags/ about the latest version
 - Update `latest` tag: TODO write instructions
 
-
 ## Website
  - Update version here:
    https://github.com/mitmproxy/www/blob/master/src/config.toml
diff --git a/release/cibuild.py b/release/cibuild.py
index 373815275..04ca9474c 100755
--- a/release/cibuild.py
+++ b/release/cibuild.py
@@ -13,6 +13,7 @@ import zipfile
 
 import click
 import cryptography.fernet
+import parver
 
 
 @contextlib.contextmanager
@@ -106,64 +107,6 @@ class BuildEnviron:
             docker_password = os.environ.get("DOCKER_PASSWORD"),
         )
 
-    @property
-    def has_docker_creds(self) -> bool:
-        return self.docker_username and self.docker_password
-
-    @property
-    def is_pull_request(self) -> bool:
-        if self.appveyor_pull_request_number:
-            return True
-        if self.travis_pull_request and self.travis_pull_request != "false":
-            return True
-        return False
-
-    @property
-    def tag(self):
-        return self.travis_tag or self.appveyor_repo_tag_name
-
-    @property
-    def branch(self):
-        return self.travis_branch or self.appveyor_repo_branch
-
-    @property
-    def version(self):
-        name = self.tag or self.branch
-        if not name:
-            raise BuildError("We're on neither a tag nor a branch - could not establish version")
-        return re.sub('^v', "", name)
-
-    @property
-    def upload_dir(self):
-        if self.tag:
-            return self.version
-        else:
-            return "branches/%s" % self.version
-
-    @property
-    def platform_tag(self):
-        if self.system in self.PLATFORM_TAGS:
-            return self.PLATFORM_TAGS[self.system]
-        raise BuildError("Unsupported platform: %s" % self.system)
-
-    @property
-    def release_dir(self):
-        return os.path.join(self.root_dir, "release")
-
-    @property
-    def build_dir(self):
-        return os.path.join(self.release_dir, "build")
-
-    @property
-    def dist_dir(self):
-        return os.path.join(self.release_dir, "dist")
-
-    @property
-    def docker_tag(self):
-        if self.branch == "master":
-            return "dev"
-        return self.version
-
     def archive(self, path):
         # ZipFile and tarfile have slightly different APIs. Fix that.
         if self.system == "Windows":
@@ -196,18 +139,24 @@ class BuildEnviron:
         return ret
 
     @property
-    def should_upload_docker(self) -> bool:
-        return all([
-            (self.tag or self.branch == "master"),
-            self.should_build_docker,
-            self.has_docker_creds,
-        ])
+    def branch(self):
+        return self.travis_branch or self.appveyor_repo_branch
 
     @property
-    def should_upload_pypi(self) -> bool:
-        if self.tag and self.should_build_wheel and self.has_twine_creds:
-            return True
-        return False
+    def build_dir(self):
+        return os.path.join(self.release_dir, "build")
+
+    @property
+    def dist_dir(self):
+        return os.path.join(self.release_dir, "dist")
+
+    @property
+    def docker_tag(self):
+        if self.branch == "master":
+            t = "dev"
+        else:
+            t = self.version
+        return "mitmproxy/mitmproxy:{}".format(t)
 
     def dump_info(self, fp=sys.stdout):
         lst = [
@@ -230,6 +179,71 @@ class BuildEnviron:
         for attr in lst:
             print("cibuild.%s=%s" % (attr, getattr(self, attr)), file=fp)
 
+    @property
+    def has_docker_creds(self) -> bool:
+        return self.docker_username and self.docker_password
+
+    @property
+    def is_prod_release(self) -> bool:
+        try:
+            v = parver.Version.parse(self.version)
+        except (parver.ParseError, BuildError):
+            return False
+        return not v.is_prerelease
+
+    @property
+    def is_pull_request(self) -> bool:
+        if self.appveyor_pull_request_number:
+            return True
+        if self.travis_pull_request and self.travis_pull_request != "false":
+            return True
+        return False
+
+    @property
+    def platform_tag(self):
+        if self.system in self.PLATFORM_TAGS:
+            return self.PLATFORM_TAGS[self.system]
+        raise BuildError("Unsupported platform: %s" % self.system)
+
+    @property
+    def release_dir(self):
+        return os.path.join(self.root_dir, "release")
+
+    @property
+    def should_upload_docker(self) -> bool:
+        return all([
+            (self.tag or self.branch == "master"),
+            self.should_build_docker,
+            self.has_docker_creds,
+        ])
+
+    @property
+    def should_upload_pypi(self) -> bool:
+        return all([
+            self.tag,
+            self.is_prod_release,
+            self.should_build_wheel,
+            self.has_twine_creds,
+        ])
+
+    @property
+    def tag(self):
+        return self.travis_tag or self.appveyor_repo_tag_name
+
+    @property
+    def upload_dir(self):
+        if self.tag:
+            return self.version
+        else:
+            return "branches/%s" % self.version
+
+    @property
+    def version(self):
+        name = self.tag or self.branch
+        if not name:
+            raise BuildError("We're on neither a tag nor a branch - could not establish version")
+        return re.sub('^v', "", name)
+
 
 def build_wheel(be: BuildEnviron):  # pragma: no cover
     click.echo("Building wheel...")
@@ -251,7 +265,7 @@ def build_docker_image(be: BuildEnviron, whl: str):  # pragma: no cover
     subprocess.check_call([
         "docker",
         "build",
-        "--tag", "mitmproxy/mitmproxy/{}".format(be.docker_tag),
+        "--tag", be.docker_tag,
         "--build-arg", "WHEEL_MITMPROXY={}".format(whl),
         "--build-arg", "WHEEL_BASENAME_MITMPROXY={}".format(os.path.basename(whl)),
         "--file", "docker/Dockerfile",
@@ -404,11 +418,7 @@ def upload():  # pragma: no cover
             "-u", be.docker_username,
             "-p", be.docker_password,
         ])
-        subprocess.check_call([
-            "docker",
-            "push",
-            "mitmproxy/mitmproxy:{}".format(be.docker_tag),
-        ])
+        subprocess.check_call(["docker", "push", be.docker_tag])
 
 
 @cli.command("decrypt")
diff --git a/setup.py b/setup.py
index 9e1e77a9b..aea2a32a5 100644
--- a/setup.py
+++ b/setup.py
@@ -89,6 +89,7 @@ setup(
             "flake8>=3.5, <3.6",
             "Flask>=1.0,<1.1",
             "mypy>=0.590,<0.591",
+            "parver>=0.1<2.0",
             "pytest-asyncio>=0.8",
             "pytest-cov>=2.5.1,<3",
             "pytest-faulthandler>=1.3.1,<2",
diff --git a/test/release/test_cibuild.py b/test/release/test_cibuild.py
index 71395c6d9..78ddf9987 100644
--- a/test/release/test_cibuild.py
+++ b/test/release/test_cibuild.py
@@ -58,6 +58,7 @@ def test_buildenviron_pr():
         appveyor_pull_request_number = "xxxx",
     )
     assert be.is_pull_request
+    assert not be.is_prod_release
 
 
 def test_buildenviron_commit():
@@ -73,10 +74,11 @@ def test_buildenviron_commit():
         docker_username = "foo",
         docker_password = "bar",
     )
-    assert be.docker_tag == "dev"
+    assert be.docker_tag == "mitmproxy/mitmproxy:dev"
     assert be.should_upload_docker
     assert not be.should_upload_pypi
     assert be.should_upload_docker
+    assert not be.is_prod_release
 
 
 def test_buildenviron_rleasetag():
@@ -99,9 +101,10 @@ def test_buildenviron_rleasetag():
     assert be.branch == "v0.x"
     assert be.version == "0.0.1"
     assert be.upload_dir == "0.0.1"
-    assert be.docker_tag == "0.0.1"
+    assert be.docker_tag == "mitmproxy/mitmproxy:0.0.1"
     assert be.should_upload_pypi
     assert be.should_upload_docker
+    assert be.is_prod_release
 
 
 def test_buildenviron_branch():