diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
deleted file mode 100644
index 2cafc4b..0000000
--- a/.github/workflows/release-image.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: Release Image
-
-on:
-  release:
-    types: [published]
-
-permissions:
-  contents: read
-  packages: write
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.release.tag_name }}
-  cancel-in-progress: false
-
-env:
-  IMAGE_NAME: ghcr.io/fullagent/fulling
-
-jobs:
-  publish-image:
-    name: Publish GHCR Image
-    runs-on: ubuntu-24.04
-
-    steps:
-      - name: Checkout release tag
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          ref: ${{ github.event.release.tag_name }}
-
-      - name: Resolve release commit
-        id: release-commit
-        run: |
-          commit_sha="$(git rev-list -n 1 "${{ github.event.release.tag_name }}")"
-          short_sha="$(git rev-parse --short "$commit_sha")"
-          echo "sha=$commit_sha" >> "$GITHUB_OUTPUT"
-          echo "short_sha=$short_sha" >> "$GITHUB_OUTPUT"
-
-      - name: Verify release commit is on main
-        run: |
-          git fetch origin main
-          git merge-base --is-ancestor "${{ steps.release-commit.outputs.sha }}" origin/main
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Extract Docker metadata
-        id: meta
-        uses: docker/metadata-action@v5
-        with:
-          images: ${{ env.IMAGE_NAME }}
-          tags: |
-            type=ref,event=tag
-            type=raw,value=sha-${{ steps.release-commit.outputs.short_sha }}
-            type=raw,value=latest,enable=${{ !github.event.release.prerelease }}
-
-      - name: Build and push image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha,scope=release-image
-          cache-to: type=gha,mode=max,scope=release-image
diff --git a/AGENTS.md b/AGENTS.md
index cda43b4..fa38a85 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -47,6 +47,46 @@ Avoid generic AI copywriting cliches such as "Elevate", "Seamless", and
 - `lib/events/` + `lib/jobs/` — Reconciliation core
 - `instrumentation.ts` — Application startup
 
+## Image Tagging Policy
+
+Manual image publishing uses a single GHCR repository:
+
+```text
+ghcr.io/fullagent/fulling
+```
+
+For formal releases tagged `vX.Y.Z`, publish:
+
+```text
+ghcr.io/fullagent/fulling:vX.Y.Z
+ghcr.io/fullagent/fulling:sha-<short-sha>
+ghcr.io/fullagent/fulling:latest
+```
+
+For prereleases tagged `vX.Y.Z-alpha.N`, `vX.Y.Z-beta.N`, or `vX.Y.Z-rc.N`,
+publish:
+
+```text
+ghcr.io/fullagent/fulling:vX.Y.Z-alpha.N
+ghcr.io/fullagent/fulling:vX.Y.Z-beta.N
+ghcr.io/fullagent/fulling:vX.Y.Z-rc.N
+ghcr.io/fullagent/fulling:sha-<short-sha>
+```
+
+Prereleases must not update `latest`.
+
+For temporary validation images that are not releases, use purpose-prefixed SHA
+tags only:
+
+```text
+ghcr.io/fullagent/fulling:dev-<short-sha>
+ghcr.io/fullagent/fulling:test-<short-sha>
+ghcr.io/fullagent/fulling:debug-<short-sha>
+```
+
+Do not use ambiguous moving tags such as `main`, `stable`, `prod`, `release`,
+`v3`, or `v3.0`.
+
 ## Development Commands
 
 ```bash