diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b6efbf..2155159 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,6 +2,8 @@ name: Release
 
 on:
   push:
+    branches:
+      - main
     tags:
       - "v*"
   workflow_dispatch:
@@ -39,8 +41,10 @@ jobs:
         with:
           images: ${{ env.REGISTRY_IMAGE }}
           tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=main,enable={{is_default_branch}}
+            type=sha,prefix=sha-
             type=ref,event=tag
-            type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/v') }}
 
       - name: Build and push image
         uses: docker/build-push-action@v6
diff --git a/README.md b/README.md
index 93a8066..641bfec 100644
--- a/README.md
+++ b/README.md
@@ -87,7 +87,8 @@ The compose file mounts `bot_database.db` so voice statistics survive container
 - Slash commands can take a minute to appear globally after the first startup.
 - Existing databases continue to work. User names are refreshed automatically as members interact again.
 - Notification on/off state is stored in SQLite.
-- CI and release now use only standard GitHub-hosted runners and GHCR publishing.
+- Pushes to `main` now publish Docker images to GHCR with `latest`, `main`, and `sha-*` tags.
+- Version tags like `v1.2.3` also create a GitHub release.
 
 ## Portugues