diff --git a/Makefile b/Makefile
index c767275..38c0476 100644
--- a/Makefile
+++ b/Makefile
@@ -50,10 +50,7 @@ release-images.txt:
 	done;
 
 tag-release:
-	(cd k8s/base && kustomize edit set image signadot/hotrod:$(RELEASE_TAG))
-	git diff-index --quiet HEAD || git commit -m tag-release-$(RELEASE_TAG) k8s/base
-	git tag -a -f -m release-$(RELEASE_TAG) $(RELEASE_TAG)
-	git push origin -f $(RELEASE_TAG)
+	./tag-release.sh $(RELEASE_TAG)
 
 release: build-release release-images.txt tag-release
 	for os in $(RELEASE_OSES); do \
@@ -69,3 +66,4 @@ generate-proto:
 	protoc --go_out=. --go_opt=paths=source_relative \
 		--go-grpc_out=. --go-grpc_opt=paths=source_relative \
 		services/route/route.proto
+
diff --git a/tag-release.sh b/tag-release.sh
new file mode 100755
index 0000000..5d934f9
--- /dev/null
+++ b/tag-release.sh
@@ -0,0 +1,52 @@
+#!/bin/sh
+#
+
+set -ex
+
+
+RELEASE_TAG=$1
+
+if [ -z ${RELEASE_TAG} ] ; then
+	echo "usage $0 <release-tag>"
+	exit 1
+fi
+
+if [ ! -d k8s/base ]; then
+	echo wrong dir
+	exit 1
+fi
+
+#
+# check for changes before editing images
+#
+set +e
+git diff  --exit-code
+if [ ! $? -eq 0 ]; then
+	echo "repository is dirty"
+	exit 1
+fi
+set -e
+
+(cd k8s/base && kustomize edit set image signadot/hotrod:${RELEASE_TAG})
+
+# do we need to commit the kustomize changes from above?
+set +e
+git diff  --exit-code
+diffCode=$?;
+
+set -e
+if [ ${diffCode} -eq 1 ] ; then 
+	git commit -m tag-release-${RELEASE_TAG} k8s/base
+	echo commited tag-release-${RELEASE_TAG}
+elif [ ${diffCode} -eq 0 ] ; then
+	echo image tag ${RELEASE_TAG} already committed
+else
+	echo "git diff-index failed"
+	exit 1
+fi
+
+
+# in any event, make sure we've tagged it locally and in-repo
+git tag -a -f -m release-${RELEASE_TAG} ${RELEASE_TAG}
+git push origin -f ${RELEASE_TAG}
+