diff --git a/ci-automation/ci_automation_common.sh b/ci-automation/ci_automation_common.sh
index e98a44ca45..181821ad92 100644
--- a/ci-automation/ci_automation_common.sh
+++ b/ci-automation/ci_automation_common.sh
@@ -48,6 +48,7 @@ function update_submodules() {
 
 function update_and_push_version() {
     local version="$1"
+    local push_to_branch="${2:-false}"
 
     # set up author and email so git does not complain when tagging
     if ! git config --get user.name >/dev/null 2>&1 ; then
@@ -71,8 +72,9 @@ function update_and_push_version() {
 
     git tag -f "${TAG_ARGS[@]}" "${version}"
 
-    if [ "${PUSH-0}" = 1 ]; then
-      git push
+    if [ "${push_to_branch}" = "true" ]; then
+      local branch="$(git rev-parse --abbrev-ref HEAD)"
+      git push origin "${branch}"
     fi
 
     if git push origin "${version}" ; then
diff --git a/ci-automation/sdk_bootstrap.sh b/ci-automation/sdk_bootstrap.sh
index 085e67e5f5..c8b33df9f4 100644
--- a/ci-automation/sdk_bootstrap.sh
+++ b/ci-automation/sdk_bootstrap.sh
@@ -84,7 +84,17 @@ function sdk_bootstrap() {
     copy_to_buildcache "sdk/${ARCH}/${vernum}" "${dest_tarball}"*
     cd -
 
-    # Create new tag in scripts repo w/ updated versionfile + submodules
-    update_and_push_version "sdk-${git_vernum}"
+    # Create new tag in scripts repo w/ updated versionfile + submodules.
+    # Also push the changes to the branch ONLY IF we're doing a nightly
+    #   build of the 'main' branch AND we're definitely ON the main branch
+    #   (`scripts` and submodules).
+    local push_branch="false"
+    if   [[ "${version}" =~ ^main-[0-9.]+-nightly-[-0-9]+$ ]] \
+       && [ "$(git rev-parse --abbrev-ref HEAD)" = "main"  ] \
+       && [ "$(git -C sdk_container/src/third_party/coreos-overlay/ rev-parse --abbrev-ref HEAD)" = "main"  ] \
+       && [ "$(git -C sdk_container/src/third_party/portage-stable/ rev-parse --abbrev-ref HEAD)" = "main"  ] ; then
+        push_branch="true"
+    fi
+    update_and_push_version "sdk-${git_vernum}" "${push_branch}"
 }
 # --