diff --git a/build/scripts/create-tags b/build/scripts/create-tags
new file mode 100755
index 0000000000..e8910f22c6
--- /dev/null
+++ b/build/scripts/create-tags
@@ -0,0 +1,77 @@
+#!/bin/bash
+# Important: This script should never cause the pipeline to fail, so that the tags can be created outside of it.
+# To run it locally, you need pass the version, i.e. export VERSION=2.39.x
+# If run locally, it:
+# - clones pmm-submodules repository and checks out the branch corresponding to the version
+# - skips git ssh configuration and expects the user to set it up ahead of time
+# - uses the current user's creds and email to push tags to the repos, therefore sufficient git permissions are required
+
+set +o errexit
+set +o nounset
+set -o xtrace
+
+# List of repositories whose release branches need to be tagged
+declare repos=(
+    "sources/pmm/src/github.com/percona/pmm"
+    "sources/grafana/src/github.com/grafana/grafana"
+    "sources/grafana-dashboards"
+    "."
+)
+
+# These setting are only needed when running in CI (Jenkins or github actions)
+if [ -n "$CI" ]; then
+  # Configure git settings globally
+  git config --global advice.detachedHead false
+  git config --global user.email "noreply@percona.com"
+  git config --global user.name "PMM Jenkins"
+
+  # Configure git to push using ssh
+  export GIT_SSH_COMMAND="/usr/bin/ssh -i ${SSHKEY} -o StrictHostKeyChecking=no -o LogLevel=error -o UserKnownHostsFile=/dev/null"
+fi
+
+TAG="v${VERSION}"
+echo "We will be tagging repos with a tag: $TAG"
+
+REPO_DIR=pmm-submodules
+if [ -d "$REPO_DIR" ]; then
+    echo "Error: the directory $REPO_DIR already exists, exiting..."
+    exit 0 # this is on purpose, we don't want to fail the pipeline
+fi
+
+if ! git clone --branch "pmm-${VERSION}" --single-branch https://github.com/Percona-Lab/pmm-submodules "$REPO_DIR"; then
+    echo "Fatal: failed to clone pmm-submodules, branch pmm-${VERSION}"
+    exit 0
+fi
+
+cd "$REPO_DIR" >/dev/null
+git submodule update
+
+for REPO in "${repos[@]}"; do
+    pushd "$REPO" >/dev/null
+        # git remote set-url origin git@github.com:${REPO}.git
+        echo "SHA: $(git rev-parse HEAD)"
+
+        # If the tag already exists, we want to delete it and re-tag this SHA
+        if git tag -l "$TAG"; then
+            echo "Fatal: tag $TAG already exists in $REPO, exiting..."
+            break
+        fi
+
+        if [ -n "$CI" ]; then
+          # We can't sign tags in CI, so we create them without signing
+          git tag --message="Version $VERSION." "$TAG"
+        else
+          git tag --message="Version $VERSION." --sign "$TAG"
+        fi
+        if ! git push origin "$TAG"; then
+            echo "Fatal: failed to tag the repository $REPO with $TAG, exiting..."
+            popd >/dev/null
+            break
+        fi
+    popd >/dev/null
+done
+
+git submodule status
+cd -
+rm -rf "$REPO_DIR"
+unset repos
diff --git a/build/scripts/create-tags.py b/build/scripts/create-tags.py
deleted file mode 100755
index a8c3a426eb..0000000000
--- a/build/scripts/create-tags.py
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/python2
-
-from __future__ import print_function, unicode_literals
-import os, subprocess, time
-
-REPOS = [
-    "sources/pmm/src/github.com/percona/pmm",
-    "sources/dbaas-controller/src/github.com/percona-platform/dbaas-controller",
-    "sources/pmm-dump",
-    "sources/pmm-qa/src/github.com/percona/pmm-qa",
-    "sources/pmm-ui-tests/src/github.com/percona/pmm-ui-tests",
-    "sources/grafana/src/github.com/grafana/grafana",
-    "sources/grafana-dashboards",
-    "sources/node_exporter/src/github.com/prometheus/node_exporter",
-    "sources/mysqld_exporter/src/github.com/percona/mysqld_exporter",
-    "sources/mongodb_exporter/src/github.com/percona/mongodb_exporter",
-    "sources/postgres_exporter/src/github.com/percona/postgres_exporter",
-    "sources/clickhouse_exporter/src/github.com/Percona-Lab/clickhouse_exporter",
-    "sources/proxysql_exporter/src/github.com/percona/proxysql_exporter",
-    "sources/rds_exporter/src/github.com/percona/rds_exporter",
-    "sources/azure_metrics_exporter/src/github.com/percona/azure_metrics_exporter",
-    ".",
-]
-
-tty = subprocess.check_output("tty", shell=True).strip()
-env = os.environ.copy()
-env["GPG_TTY"] = tty
-
-with open("./VERSION", "r") as f:
-    version = f.read().strip()
-
-print(tty, version)
-
-subprocess.check_call("git submodule update", shell=True)
-
-for repo in REPOS:
-    print("==>", repo)
-
-    tag = "v" + version
-    cmd = "git tag --message='Version {version}.' --sign {tag}".format(version=version, tag=tag)
-    print(">", cmd)
-    subprocess.check_call(cmd, shell=True, cwd=repo, env=env)
-
-    cmd = "git push origin {tag}".format(tag=tag)
-    print(">", cmd)
-    subprocess.check_call(cmd, shell=True, cwd=repo)
-
-subprocess.check_call("git submodule status", shell=True)