diff --git a/.github/workflows/tag.yml b/.github/workflows/tag.yml
index f1f5400..5314bca 100644
--- a/.github/workflows/tag.yml
+++ b/.github/workflows/tag.yml
@@ -34,7 +34,7 @@ jobs:
         run: |
           earthly account login --token ${{ secrets.EARTHLY_SAT_TOKEN }} >> /dev/null
           earthly org s blue-build
-          earthly sat s blue-build
+          earthly sat s blue-build-tag
 
       - name: Set up Python
         uses: actions/setup-python@v5
diff --git a/templates/Containerfile.j2 b/templates/Containerfile.j2
index c2408c8..bf2908e 100644
--- a/templates/Containerfile.j2
+++ b/templates/Containerfile.j2
@@ -46,9 +46,10 @@ ARG CONFIG_DIRECTORY="/tmp/config"
 ARG IMAGE_NAME="{{ recipe.name }}"
 ARG BASE_IMAGE="{{ recipe.base_image }}"
 
+COPY --from=gcr.io/projectsigstore/cosign /ko-app/cosign /usr/bin/cosign
+COPY --from=docker.io/mikefarah/yq /usr/bin/yq /usr/bin/yq
 {%- include "modules/modules.j2" %}
 
-COPY --from=gcr.io/projectsigstore/cosign /ko-app/cosign /usr/bin/cosign
 COPY --from=ghcr.io/blue-build/cli:
 {%- if let Some(tag) = recipe.blue_build_tag -%}
 {{ tag }}
diff --git a/templates/modules/modules.j2 b/templates/modules/modules.j2
index 26f7233..0ac9af2 100644
--- a/templates/modules/modules.j2
+++ b/templates/modules/modules.j2
@@ -8,7 +8,6 @@
 RUN \
   --mount=type=tmpfs,target=/tmp \
   --mount=type=tmpfs,target=/var \
-  --mount=type=bind,from=docker.io/mikefarah/yq,src=/usr/bin/yq,dst=/usr/bin/yq \
   --mount=type=bind,from=stage-config,src=/config,dst=/tmp/config,rw \
       {%- if let Some(source) = module.source %}
   --mount=type=bind,from={{ source }},src=/modules,dst=/tmp/modules,rw \