diff --git a/.github/workflows/ngwpc-cicd.yml b/.github/workflows/ngwpc-cicd.yml
index b11489d176..ce30ccde75 100644
--- a/.github/workflows/ngwpc-cicd.yml
+++ b/.github/workflows/ngwpc-cicd.yml
@@ -8,6 +8,7 @@ on:
       - main
       - nwm-main
       - development
+      - development-pw
       - release-candidate
   push:
     branches:
@@ -16,6 +17,7 @@ on:
       - main
       - nwm-main
       - development
+      - development-pw
       - release-candidate
   workflow_dispatch:
     inputs:
@@ -80,6 +82,7 @@ jobs:
       alias_tag: ${{ steps.vars.outputs.alias_tag }}
       clean_ref: ${{ steps.vars.outputs.clean_ref }}
       default_ref: ${{ steps.vars.outputs.default_ref }}
+      default_base_tag: ${{ steps.vars.outputs.default_base_tag }}
       ngen_forcing_digest: ${{ steps.vars.outputs.ngen_forcing_digest }}
       ngen_forcing_revision: ${{ steps.vars.outputs.ngen_forcing_revision }}
       ewts_revision: ${{ steps.vars.outputs.ewts_revision }}
@@ -115,10 +118,11 @@ jobs:
           SHORT_SHA="${REAL_SHA:0:7}"
 
           # default source-repo ref: follow the release-line branch we're building from
-          # (development / ngwpc-candidate / ngwpc-release); tags and other branches fall
-          # back to development. Override per source repo via the *_REF dispatch inputs.
+          # (development / development-pw / ngwpc-candidate / ngwpc-release); tags and
+          # other branches fall back to development. Override per source repo via the
+          # *_REF dispatch inputs.
           case "${GITHUB_REF_TYPE}:${GITHUB_REF_NAME}" in
-            branch:development|branch:ngwpc-candidate|branch:ngwpc-release)
+            branch:development|branch:development-pw|branch:ngwpc-candidate|branch:ngwpc-release)
               DEFAULT_REF="$GITHUB_REF_NAME" ;;
             *)
               DEFAULT_REF="development" ;;
@@ -126,6 +130,16 @@ jobs:
           # use an explicit *_REF input if provided, else DEFAULT_REF
           ref_or_default() { [ -n "$1" ] && echo "$1" || echo "$DEFAULT_REF"; }
 
+          # base-image alias follows the lane: development-pw (or a PR into it) pulls
+          # the rocky 'latest-pw' alias, every other ref the bookworm 'latest'. An
+          # explicit NGEN_FORCING_IMAGE_TAG input always wins over this default.
+          LANE_REF="${GITHUB_BASE_REF:-$GITHUB_REF_NAME}"
+          if [ "$LANE_REF" = "development-pw" ]; then
+            DEFAULT_BASE_TAG="latest-pw"
+          else
+            DEFAULT_BASE_TAG="latest"
+          fi
+
           # logic for the tags:
           # test_image_tag (commit short sha): used for the initial build and test
           # alias_tag: used for final tagging on successful tests
@@ -151,7 +165,8 @@ jobs:
           fi
 
           # base image (ngen-forcing) metadata for ngen Dockerfile labels
-          NGEN_FORCING_IMAGE_TAG="${{ inputs.NGEN_FORCING_IMAGE_TAG || 'latest' }}"
+          NGEN_FORCING_IMAGE_TAG="${{ inputs.NGEN_FORCING_IMAGE_TAG }}"
+          NGEN_FORCING_IMAGE_TAG="${NGEN_FORCING_IMAGE_TAG:-$DEFAULT_BASE_TAG}"
           NGEN_FORCING_IMAGE="ghcr.io/${ORG}/ngen-bmi-forcing:${NGEN_FORCING_IMAGE_TAG}"
           NGEN_FORCING_INSPECT=$(skopeo inspect --override-os linux --override-arch amd64 "docker://${NGEN_FORCING_IMAGE}" 2>/dev/null || echo '{}')
           NGEN_FORCING_DIGEST=$(echo "$NGEN_FORCING_INSPECT" | jq -r '.Digest // "unknown"')
@@ -184,6 +199,7 @@ jobs:
           commit_sha_short=${SHORT_SHA}
           clean_ref=${CLEAN_REF}
           default_ref=${DEFAULT_REF}
+          default_base_tag=${DEFAULT_BASE_TAG}
           ngen_forcing_digest=${NGEN_FORCING_DIGEST}
           ngen_forcing_revision=${NGEN_FORCING_REVISION}
           ewts_revision=${EWTS_REVISION}
@@ -259,7 +275,7 @@ jobs:
           tags: ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.test_image_tag }}
           build-args: |
             GHCR_ORG=${{ inputs.GHCR_ORG || needs.setup.outputs.org }}
-            FORCING_IMAGE=ghcr.io/${{ needs.setup.outputs.org }}/ngen-bmi-forcing:${{ inputs.NGEN_FORCING_IMAGE_TAG || 'latest' }}
+            FORCING_IMAGE=ghcr.io/${{ needs.setup.outputs.org }}/ngen-bmi-forcing:${{ inputs.NGEN_FORCING_IMAGE_TAG || needs.setup.outputs.default_base_tag }}
             FORCING_IMAGE_DIGEST=${{ needs.setup.outputs.ngen_forcing_digest }}
             FORCING_IMAGE_REVISION=${{ needs.setup.outputs.ngen_forcing_revision }}
             EWTS_ORG=${{ inputs.EWTS_ORG || github.repository_owner }}
@@ -368,13 +384,23 @@ jobs:
             --all \
             "docker://${IMAGE_BASE}:${TEST_TAG}" "docker://${IMAGE_BASE}:${ALIAS_TAG}"
 
-          # tag with 'latest' on development branch
+          # Branch-keyed promotion: development promotes 'latest' (bookworm/AWS
+          # lane); development-pw promotes 'latest-pw' (rocky/PW lane). Do not
+          # manually dispatch a cross-lane build from either branch: promotion
+          # keys off the branch name, so the tested image would promote under
+          # the wrong alias.
           if [ "$GITHUB_REF_NAME" = "development" ]; then
             skopeo copy \
               --src-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" \
               --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" \
               --all \
               "docker://${IMAGE_BASE}:${TEST_TAG}" "docker://${IMAGE_BASE}:latest"
+          elif [ "$GITHUB_REF_NAME" = "development-pw" ]; then
+            skopeo copy \
+              --src-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" \
+              --dest-creds "${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}" \
+              --all \
+              "docker://${IMAGE_BASE}:${TEST_TAG}" "docker://${IMAGE_BASE}:latest-pw"
           fi
 
   # trigger downstream repos, nwm-cal-mgr and nwm-fcst-mgr
@@ -382,7 +408,7 @@ jobs:
     name: trigger-downstream (${{ matrix.repo }})
     if: |
       success() && (
-        (github.event_name == 'push' && (github.ref_name == 'development' || github.ref_name == 'ngwpc-candidate' || github.ref_name == 'ngwpc-release')) ||
+        (github.event_name == 'push' && (github.ref_name == 'development' || github.ref_name == 'development-pw' || github.ref_name == 'ngwpc-candidate' || github.ref_name == 'ngwpc-release')) ||
         (github.event_name == 'workflow_dispatch' && inputs.TRIGGER_DOWNSTREAM)
       )
     runs-on: ubuntu-latest