diff --git a/roles/koji_hub/templates/hub.conf.j2 b/roles/koji_hub/templates/hub.conf.j2
index 47c6a75f4c..146923578b 100644
--- a/roles/koji_hub/templates/hub.conf.j2
+++ b/roles/koji_hub/templates/hub.conf.j2
@@ -94,9 +94,10 @@ tag =
     # CoreOS continuous builds, https://pagure.io/releng/issue/8165
     operation tag && tag f{{FedoraRawhideNumber}}-coreos-continuous f{{FedoraBranchedNumber}}-coreos-continuous f{{FedoraCycleNumber}}-coreos-continuous f{{FedoraPreviousCycleNumber}}-coreos-continuous && has_perm coreos-continuous :: allow
     operation untag && fromtag f{{FedoraRawhideNumber}}-coreos-continuous f{{FedoraBranchedNumber}}-coreos-continuous f{{FedoraCycleNumber}}-coreos-continuous f{{FedoraPreviousCycleNumber}}-coreos-continuous && has_perm coreos-continuous :: allow
-    # CoreOS coreos-pool and coreos-release tags, https://pagure.io/releng/issue/8294
-    operation tag && tag coreos-pool coreos-release && has_perm coreos-continuous :: allow
-    operation untag && fromtag coreos-pool coreos-release && has_perm coreos-continuous :: allow
+    # CoreOS coreos-pool and intermediate signing tags as well
+    # as the coreos-release tag. https://pagure.io/releng/issue/8294
+    operation tag && tag coreos-pool f*-coreos-signing-pending coreos-release && has_perm coreos-continuous :: allow
+    operation untag && fromtag coreos-pool f*-coreos-signing-pending coreos-release && has_perm coreos-continuous :: allow
     # deny tagging secureboot packages that are not related to coreos-continuous
     package kernel shim grub2 fedora-release fedora-repos pesign :: deny
 # Allow people to tag stuff into infra-candidate if they're infra
@@ -159,11 +160,8 @@ package_list =
     tag *infra* && has_perm infra && match action add unblock block :: allow
     # CoreOS continuous builds, https://pagure.io/releng/issue/8165
     tag f{{FedoraRawhideNumber}}-coreos-continuous f{{FedoraBranchedNumber}}-coreos-continuous f{{FedoraCycleNumber}}-coreos-continuous f{{FedoraPreviousCycleNumber}}-coreos-continuous && has_perm coreos-continuous && match action add unblock block :: allow
-    # CoreOS coreos-release tag https://pagure.io/releng/issue/8294
-    tag coreos-release && has_perm coreos-continuous && match action add unblock block :: allow
-    # CoreOS coreos-pool tag and intermediate signing tags that lead
-    # to coreos-pool https://pagure.io/releng/issue/8294
-    tag coreos-pool f{{FedoraRawhideNumber}}-coreos-signing-pending f{{FedoraBranchedNumber}}-coreos-signing-pending f{{FedoraCycleNumber}}-coreos-signing-pending f{{FedoraPreviousCycleNumber}}-coreos-signing-pending && has_perm coreos-continuous && match action add unblock block :: allow
+    # CoreOS coreos-pool and coreos-release tags, https://pagure.io/releng/issue/8294
+    tag coreos-pool coreos-release && has_perm coreos-continuous && match action add unblock block :: allow
     # Catch-all rule.
     all :: deny