diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c86bdee..f99f3a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,7 @@ name: ci
 on:
   push:
     branches: ["**"]
+    tags: ["v*"]
   pull_request:
 
 jobs:
@@ -24,6 +25,9 @@ jobs:
 
   image:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
       - uses: actions/checkout@v4
       - run: docker build -t coderoot-mcp:ci .
@@ -55,3 +59,27 @@ jobs:
           grep -q "refusing to start without CODEROOT_API_URL" out.log || {
             echo "FAIL: exited non-zero but not for the fail-closed reason"; cat out.log; exit 1; }
           echo "OK: refused to start, exit=$code"
+
+      # Publish the (already-built, fail-closed-verified) image to GHCR so it can
+      # be pulled and run locally: `docker pull ghcr.io/settletop-inc/coderoot-mcp`.
+      # Only on main (-> :latest + :sha-<short>) and release tags (-> :vX.Y.Z);
+      # PRs and feature branches build + test only, never push.
+      - name: Log in to GHCR
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Tag and push to GHCR
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v'))
+        run: |
+          image=$(echo "ghcr.io/${{ github.repository_owner }}/coderoot-mcp" | tr '[:upper:]' '[:lower:]')
+          push() { docker tag coderoot-mcp:ci "$image:$1"; docker push "$image:$1"; echo "pushed $image:$1"; }
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            push latest
+            push "sha-$(echo '${{ github.sha }}' | cut -c1-7)"
+          fi
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            push "${{ github.ref_name }}"
+          fi