diff --git a/clustertest/main_test.go b/clustertest/main_test.go
index b85c6725..10212697 100644
--- a/clustertest/main_test.go
+++ b/clustertest/main_test.go
@@ -21,17 +21,27 @@ var testConfig = struct {
 }{}
 
 func TestMain(m *testing.M) {
-	defaultImageTag := "127.0.0.1:5000/control-plane:" + os.Getenv("CONTROL_PLANE_VERSION")
-
 	flag.BoolVar(&testConfig.skipCleanup, "skip-cleanup", false, "skip cleaning up resources created by the tests")
 	flag.BoolVar(&testConfig.skipImageBuild, "skip-image-build", false, "skip building the control plane image. this setting is implied true when a non-default image-tag is specified.")
-	flag.StringVar(&testConfig.imageTag, "image-tag", defaultImageTag, "the control plane image to test")
+	flag.StringVar(&testConfig.imageTag, "image-tag", "", "the control plane image to test")
 	flag.StringVar(&testConfig.dataDirPrefix, "data-dir", "", "the directory to store test data. defaults to clustertest/data")
 
 	flag.Parse()
 
-	if !testConfig.skipImageBuild && testConfig.imageTag == defaultImageTag {
-		buildImage()
+	if testConfig.imageTag == "" {
+		// No explicit image tag: derive the default from CONTROL_PLANE_VERSION.
+		// Fatal here (after flag parsing) so runs that supply -image-tag are
+		// never blocked by a missing version.
+		version := os.Getenv("CONTROL_PLANE_VERSION")
+		if version == "" {
+			log.Fatal("CONTROL_PLANE_VERSION is not set; ensure common.mk version resolution succeeded or pass -image-tag explicitly")
+		}
+		testConfig.imageTag = "127.0.0.1:5000/control-plane:" + version
+		if !testConfig.skipImageBuild {
+			buildImage()
+		} else {
+			log.Println("skipping image build")
+		}
 	} else {
 		log.Println("skipping image build")
 	}
diff --git a/common.mk b/common.mk
index 2909b82b..db311db5 100644
--- a/common.mk
+++ b/common.mk
@@ -12,7 +12,10 @@ go-licenses=$(gobin)/go-licenses
 CHANGIE_LATEST = $(shell $(changie) latest)
 # deferred simple variable expansion pattern:
 # https://make.mad-scientist.net/deferred-simple-variable-expansion/
-CONTROL_PLANE_VERSION ?= $(eval CONTROL_PLANE_VERSION := $$(shell git fetch --quiet && git describe --tags --abbrev=0 --match 'v*' release/$$(CHANGIE_LATEST)))$(CONTROL_PLANE_VERSION)
+# The 'git fetch' and 'git describe' will return the latest tag if we're on the
+# release branch. The 'echo' returns our fallback for every other branch,
+# including main.
+CONTROL_PLANE_VERSION ?= $(eval CONTROL_PLANE_VERSION := $$(shell git fetch --quiet --tags && git describe --tags --abbrev=0 --match '$$(CHANGIE_LATEST)*' 2>/dev/null || echo '$$(CHANGIE_LATEST)'))$(CONTROL_PLANE_VERSION)
 
 .PHONY: install-tools
 install-tools: