diff --git a/cli/trust/trust.go b/cli/trust/trust.go
index 7af2a27350..a70a496669 100644
--- a/cli/trust/trust.go
+++ b/cli/trust/trust.go
@@ -346,9 +346,9 @@ func GetImageReferencesAndAuth(ctx context.Context,
 
 func getTag(ref reference.Named) string {
 	switch x := ref.(type) {
-	case reference.Canonical, reference.Digested:
-		return ""
-	case reference.NamedTagged:
+	case reference.Digested:
+		return "" // TODO(thaJeztah): is it intentional to discard the tag when "Tagged+Digested"?
+	case reference.Tagged:
 		return x.Tag()
 	default:
 		return ""
@@ -357,12 +357,10 @@ func getTag(ref reference.Named) string {
 
 func getDigest(ref reference.Named) digest.Digest {
 	switch x := ref.(type) {
-	case reference.Canonical:
-		return x.Digest()
 	case reference.Digested:
 		return x.Digest()
 	default:
-		return digest.Digest("")
+		return ""
 	}
 }
 
diff --git a/cli/trust/trust_push.go b/cli/trust/trust_push.go
index 47057b3f48..ef7f19f1af 100644
--- a/cli/trust/trust_push.go
+++ b/cli/trust/trust_push.go
@@ -63,9 +63,9 @@ func PushTrustedReference(ctx context.Context, ioStreams Streams, repoInfo *Repo
 
 	var tag string
 	switch x := ref.(type) {
-	case reference.Canonical:
+	case reference.Digested:
 		return errors.New("cannot push a digest reference")
-	case reference.NamedTagged:
+	case reference.Tagged:
 		tag = x.Tag()
 	default:
 		// We want trust signatures to always take an explicit tag,