diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml
index 13eff11..f613d40 100644
--- a/.gitea/workflows/docker-publish.yml
+++ b/.gitea/workflows/docker-publish.yml
@@ -1,8 +1,12 @@
 name: Publish Docker image
 
+# Two channels, not one-image-per-commit:
+#   - push to `dev`   -> rolling `:dev` tag, for testing in-progress work
+#   - push tag `v*`   -> `:latest` + the version tag, for actual releases
+# Plain commits/merges to master/main build nothing on their own.
 on:
   push:
-    branches: [main, master]
+    branches: [dev]
     tags: ['v*']
 
 permissions:
@@ -20,6 +24,24 @@ jobs:
       - name: Compute lowercase image name
         run: echo "IMAGE_NAME=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
 
+      - name: Compute image tags
+        run: |
+          if [ "${{ github.ref_type }}" = "tag" ]; then
+            VERSION="${{ github.ref_name }}"
+            TAGS="${{ vars.REGISTRY_HOST }}/${IMAGE_NAME}:latest
+          ${{ vars.REGISTRY_HOST }}/${IMAGE_NAME}:${VERSION}
+          ghcr.io/${IMAGE_NAME}:latest
+          ghcr.io/${IMAGE_NAME}:${VERSION}"
+          else
+            TAGS="${{ vars.REGISTRY_HOST }}/${IMAGE_NAME}:dev
+          ghcr.io/${IMAGE_NAME}:dev"
+          fi
+          {
+            echo "TAGS<<TAGS_EOF"
+            echo "$TAGS"
+            echo "TAGS_EOF"
+          } >> "$GITHUB_ENV"
+
       - name: Log in to Gitea container registry
         uses: docker/login-action@v3
         with:
@@ -39,8 +61,4 @@ jobs:
         with:
           context: .
           push: true
-          tags: |
-            ${{ vars.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:latest
-            ${{ vars.REGISTRY_HOST }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
-            ghcr.io/${{ env.IMAGE_NAME }}:latest
-            ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}
+          tags: ${{ env.TAGS }}
diff --git a/GIT_WORKFLOW.md b/GIT_WORKFLOW.md
index b0f5030..97798a5 100644
--- a/GIT_WORKFLOW.md
+++ b/GIT_WORKFLOW.md
@@ -51,6 +51,19 @@ Types: `feat`, `fix`, `refactor`, `style`, `docs`, `chore`, `test`.
 Tag production releases as `v<major>.<minor>.<patch>` (semver) once this
 project has a deployment cadence worth marking. Not required for every merge.
 
+## Docker images
+
+CI (`.gitea/workflows/docker-publish.yml`) only builds an image on two
+events, not on every commit:
+
+- push to `dev` — builds a rolling `:dev` tag, for testing in-progress work
+  before it's ready to release.
+- push a `v*` tag — builds `:latest` plus the version tag, for actual
+  releases.
+
+Push to `dev` when you want a throwaway build to test; tag a release on
+`main`/`master` when you want a real one.
+
 ## What not to commit
 
 - Anything in `.gitignore` (`.env`, `/data`, `.next`, `node_modules`, prisma