diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 98db9ba..fa251af 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -77,12 +77,12 @@ jobs:
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}
-          # Skip the "latest" tag for prerelease refs (e.g. v1.0.0-RC-3) so
-          # they never clobber the stable tag.
+          # latest=auto emits "latest" for stable semver and skips prereleases.
+          flavor: |
+            latest=auto
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
-            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-') }}
 
       - name: ✅  Validate derived tags
         run: |
@@ -143,7 +143,7 @@ jobs:
             ## Container image
 
             ```
-            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ github.ref_name }}
+            docker pull ${{ env.REGISTRY }}/${{ env.IMAGE_NAME_LC }}:${{ steps.meta.outputs.version }}
             ```
 
             Signed with [Cosign](https://docs.sigstore.dev/cosign/overview/) (keyless OIDC) — verify with:
diff --git a/DOCKER.md b/DOCKER.md
index 02b132d..452873d 100644
--- a/DOCKER.md
+++ b/DOCKER.md
@@ -20,14 +20,15 @@ point `CONTEXTFORGE_URL` at.
 
 ## Published image
 
-Tagged releases (`vX.Y.Z`, matching the repo's git tags) are built and
-pushed to GHCR by `.github/workflows/docker-release.yml`:
+Tagged releases are built and pushed to GHCR by
+`.github/workflows/docker-release.yml`. Note that the image tag drops the
+`v` the git tag carries — git `vX.Y.Z` publishes as image `X.Y.Z`:
 
 ```bash
-docker pull ghcr.io/contextforge-org/contextforge-web-ui:vX.Y.Z
+docker pull ghcr.io/contextforge-org/contextforge-web-ui:X.Y.Z
 ```
 
-Also available: the `vX.Y` (minor) tag, and `latest` (stable releases
+Also available: the `X.Y` (minor) tag, and `latest` (stable releases
 only — prerelease/RC tags don't move it). Built for `linux/amd64` and
 `linux/arm64`. See the repo's **Releases** and **Packages** tabs for the
 full list of published tags, signatures, and SBOMs.
@@ -39,7 +40,7 @@ locally, override the `app` service's `build:` key with `image:`:
 # docker-compose.override.yml
 services:
   app:
-    image: ghcr.io/contextforge-org/contextforge-web-ui:vX.Y.Z
+    image: ghcr.io/contextforge-org/contextforge-web-ui:X.Y.Z
 ```
 
 ```bash