diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 3f6665027f2e05c808816e1fac80ce8a2cc2d064..40521e121b4293362834f9bd29af773c2cdcc703 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -17,10 +17,11 @@ build:
   stage: build
   script:
     - docker version
-    - if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_PASSWORD" ]; then docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD; fi
-    - echo "Ignore warning! Cannot perform an interactive login from a non TTY device"
     - docker build -t $IMAGE_ORG/$IMAGE_NAME:$CI_COMMIT_SHA .
-    - if [ -n "$DOCKERHUB_USERNAME" ] && [ -n "$DOCKERHUB_PASSWORD" ]; then docker push $IMAGE_ORG/$IMAGE_NAME:$CI_COMMIT_SHA; fi
+    - if [ -z "$DOCKERHUB_USERNAME" ] || [ -z "$DOCKERHUB_PASSWORD" ]; then echo "Not pushing" && exit 0; fi
+    - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD
+    - echo "Ignore warning! Cannot perform an interactive login from a non TTY device"
+    - docker push $IMAGE_ORG/$IMAGE_NAME:$CI_COMMIT_SHA
 
 lint:style:
   image: $IMAGE_ORG/$IMAGE_NAME:$CI_COMMIT_SHA
@@ -49,6 +50,19 @@ test:
     - cd ${HOME}
     - NODE_ENV=test npm run test
 
+# if tests pass we will push latest, labelled with current commit hash
+push:latest:
+  image: docker:latest
+  stage: staging
+  script:
+    - if [ -z "$DOCKERHUB_USERNAME" ] || [ -z "$DOCKERHUB_PASSWORD" ]; then echo "Not pushing" && exit 0; fi
+    - docker login -u $DOCKERHUB_USERNAME -p $DOCKERHUB_PASSWORD
+    - echo "Ignore warning! Cannot perform an interactive login from a non TTY device"
+    - docker build -t $IMAGE_ORG/$IMAGE_NAME:latest --label COMMIT_SHA=$CI_COMMIT_SHA .
+    - docker push $IMAGE_ORG/$IMAGE_NAME:latest
+  only:
+  - master
+
 # -----------------------------------------------
 # ui --------------------------------------------
 # -----------------------------------------------