diff --git a/docs/images/automated-debian-jobs.uml b/docs/images/automated-debian-jobs.uml
--- a/docs/images/automated-debian-jobs.uml
+++ b/docs/images/automated-debian-jobs.uml
@@ -6,9 +6,6 @@
   box "Phabricator" #LightBlue
   participant GIT as "Repository\ntags"
   participant HOOK as "post-receive\nhook"
-  participant GIT_DEBIAN_UNSTABLE as "debian/unstable-swh"
-  participant GIT_DEBIAN_BPO as "debian/<stable>-swh"
-  participant Harbormaster
   end box
 
   box "Jenkins" #LightBlue
@@ -46,70 +43,62 @@
   hnote over UFR : pull tarball from PyPI job
   hnote over UFR : run gbp import-orig
   hnote over UFR : update debian/changelog
+  hnote over UFR : tag new debian version\non unstable-swh branch
 
-  UFR -> GIT_DEBIAN_UNSTABLE : push updated branches
-  activate GIT_DEBIAN_UNSTABLE
+  UFR -> GIT : push debian version tag
   deactivate UFR
 
-  GIT_DEBIAN_UNSTABLE -> Harbormaster : on new commits
-  deactivate GIT_DEBIAN_UNSTABLE
-  activate Harbormaster
-  Harbormaster -> GBP : trigger jenkins job
-  activate GBP
-  deactivate Harbormaster
-
-  hnote over GBP : checkout branches
-  hnote over GBP : run gbp buildpackage
-
-  GBP -> REPO : push packages to unstable-swh
-  GBP -> GIT : push debian/<unstable-swh version> tag
   activate GIT
-  deactivate GBP
-
   GIT -> HOOK : run hook
-  activate HOOK
+  deactivate GIT
 
+  activate HOOK
   HOOK -> IT : trigger Jenkins job
-  activate IT
   deactivate HOOK
-  deactivate GIT
 
-  hnote over IT : debian unstable-swh\ntag detected
-  create ABP
-  IT -> ABP : trigger
-  activate ABP
-  ABP -> IT : acknowledge start
-  deactivate IT
+  activate IT
 
-  hnote over ABP : merge pushed tag
-  hnote over ABP : update changelog\nwith backports mention
-  ABP -> GIT_DEBIAN_BPO : push updated branches
-  activate GIT_DEBIAN_BPO
-  deactivate ABP
+  hnote over IT : debian version\ntag detected
 
-  GIT_DEBIAN_BPO -> Harbormaster : on new commits
-  deactivate GIT_DEBIAN_BPO
-  activate Harbormaster
-  Harbormaster -> GBP : trigger jenkins job
+  IT -> GBP : trigger
   activate GBP
-  deactivate Harbormaster
+  GBP -> IT : acknowledge start
+  deactivate IT
 
   hnote over GBP : checkout branches
   hnote over GBP : run gbp buildpackage
 
-  GBP -> REPO : push packages to <stable>-swh
-  GBP -> GIT : push debian/<stable-swh version> tag
+  GBP -> REPO : push packages to unstable-swh
+
+  create ABP
+  activate ABP
   deactivate GBP
 
+  hnote over ABP : merge pushed tag
+  hnote over ABP : update changelog\nwith backports mention
+  hnote over ABP : tag new debian version\non <stable>-swh branch
+  ABP -> GIT : push debian version tag
+  deactivate ABP
+
+  activate GIT
   GIT -> HOOK : run hook
-  activate HOOK
+  deactivate GIT
 
+  activate HOOK
   HOOK -> IT : trigger Jenkins job
-  activate IT
   deactivate HOOK
-  deactivate GIT
-  hnote over IT : debian stable-swh\ntag detected
-  IT --> IT : ignoring
+
+  activate IT
+  hnote over IT : debian version\ntag detected
+  IT -> GBP : trigger
+
+  activate GBP
+  GBP -> IT : acknowledge start
   deactivate IT
 
+  hnote over GBP : checkout branches
+  hnote over GBP : run gbp buildpackage
+
+  GBP -> REPO : push packages to <stable>-swh
+  deactivate GBP
 @enduml
diff --git a/jobs/templates/debian/automatic-backport.groovy b/jobs/templates/debian/automatic-backport.groovy
--- a/jobs/templates/debian/automatic-backport.groovy
+++ b/jobs/templates/debian/automatic-backport.groovy
@@ -105,6 +105,17 @@
         }}
       }}
     }}
+    stage('Tag package') {{
+      when {{
+        beforeAgent true
+        expression {{ backport_ok }}
+      }}
+      steps {{
+        withEnv(environment) {{
+          sh 'gbp buildpackage --git-tag-only'
+        }}
+      }}
+    }}
     stage('Upload changes') {{
       when {{
         beforeAgent true
diff --git a/jobs/templates/debian/gbp-buildpackage.groovy b/jobs/templates/debian/gbp-buildpackage.groovy
--- a/jobs/templates/debian/gbp-buildpackage.groovy
+++ b/jobs/templates/debian/gbp-buildpackage.groovy
@@ -240,21 +240,6 @@
         }}
       }}
     }}
-    stage('Tag package') {{
-      when {{
-        beforeAgent true
-        expression {{ changelog_distribution != 'UNRELEASED' }}
-        expression {{ params.DO_TAG }}
-     }}
-      steps {{
-        dir (repo_name) {{
-          sh 'gbp buildpackage --git-tag-only'
-          sshagent (credentials: ['jenkins-public-ci-ssh']) {{
-            sh 'git push --tags'
-          }}
-        }}
-      }}
-    }}
   }}
   post {{
     always {{
diff --git a/jobs/templates/debian/gbp-buildpackage.yaml b/jobs/templates/debian/gbp-buildpackage.yaml
--- a/jobs/templates/debian/gbp-buildpackage.yaml
+++ b/jobs/templates/debian/gbp-buildpackage.yaml
@@ -44,10 +44,6 @@
           name: DO_UPLOAD
           description: upload the built package
           default: false
-      - bool:
-          name: DO_TAG
-          description: tag the repository once the package has been built
-          default: false
     dsl:
       !include-raw: gbp-buildpackage.groovy
 
diff --git a/jobs/templates/debian/update-for-release.groovy b/jobs/templates/debian/update-for-release.groovy
--- a/jobs/templates/debian/update-for-release.groovy
+++ b/jobs/templates/debian/update-for-release.groovy
@@ -127,6 +127,7 @@
               git add debian/changelog
               git commit --no-verify -m "Updated debian changelog for version ${{UPSTREAM_VERSION}}"
               git show
+              gbp buildpackage --git-tag-only
             '''
           }}
         }}
diff --git a/jobs/templates/incoming-tag.groovy b/jobs/templates/incoming-tag.groovy
--- a/jobs/templates/incoming-tag.groovy
+++ b/jobs/templates/incoming-tag.groovy
@@ -50,18 +50,18 @@
         )
       }}
     }}
-    stage('Debian automatic backport') {{
+    stage('Build Debian package') {{
       when {{
         expression {{ params.GIT_TAG ==~ /debian\/.*/ }}
         expression {{ !(params.GIT_TAG ==~ /debian\/upstream\/.*/) }}
-        expression {{ !(params.GIT_TAG =~ /_bpo/) }}
-        expression {{ jobExists('/debian/packages/{name}/automatic-backport') }}
+        expression {{ jobExists('/debian/packages/{name}/gbp-buildpackage') }}
       }}
       steps {{
         build(
-          job: '/debian/packages/{name}/automatic-backport',
+          job: '/debian/packages/{name}/gbp-buildpackage',
           parameters: [
-            string(name: 'GIT_TAG', value: params.GIT_TAG),
+            string(name: 'GIT_REVISION', value: params.GIT_TAG),
+            booleanParam(name: 'DO_UPLOAD', value: true),
           ],
           wait: false,
         )