diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9d15ce..d60a6bb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,7 @@ on:
     branches: [main]
   push:
     branches: [main]
+    tags: ["v*"]
 
 jobs:
   build-and-test:
@@ -57,3 +58,32 @@ jobs:
           --source "https://nuget.pkg.github.com/vectorloom/index.json"
           --api-key ${{ secrets.GITHUB_TOKEN }}
           --skip-duplicate
+
+  # Publishes the RiftCache core service image to GHCR on every version tag, so `docker run
+  # ghcr.io/vectorloom/rift-cache:vX.Y.Z` works without cloning/building. Tagged separately from
+  # publish-client-preview since tag pushes aren't branch pushes to main.
+  publish-docker-image:
+    needs: build-and-test
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: deployment/docker/Dockerfile
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ github.ref_name }}
+            ghcr.io/${{ github.repository }}:latest
diff --git a/README.md b/README.md
index b754ce9..83470cc 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,7 @@ RiftCache is a distributed cache built to slot into infrastructure you already r
 ## Quick Start (Self-Hosted)
 
 ```bash
-docker run --name riftcache -p 8080:8080 -e RIFTCACHE_API_KEY=dev-key riftcache/riftcache:latest
+docker run --name riftcache -p 8080:8080 -e RIFTCACHE_API_KEY=dev-key ghcr.io/vectorloom/rift-cache:latest
 ```
 
 > **Two different names, easy to mix up when testing manually:** `RIFTCACHE_API_KEY` above is the
@@ -44,9 +44,10 @@ docker run --name riftcache -p 8080:8080 -e RIFTCACHE_API_KEY=dev-key riftcache/
 > Callers authenticate with the **HTTP header** `X-RiftCache-Api-Key` instead — see the curl
 > example under [Building From Source](#building-from-source-docker--podman) below.
 
-No published image yet — until there is, build it from source (below). The image is a
-multi-stage build of just `src/RiftCache`, so it stays cloud-agnostic: no Azure/AWS/GCP
-SDKs baked in, per [ARCHITECTURE.md](ARCHITECTURE.md).
+Published to GHCR on every version tag (`ghcr.io/vectorloom/rift-cache:vX.Y.Z`, plus a rolling
+`:latest`) — or build it from source (below). The image is a multi-stage build of just
+`src/RiftCache`, so it stays cloud-agnostic: no Azure/AWS/GCP SDKs baked in, per
+[ARCHITECTURE.md](ARCHITECTURE.md).
 
 ```csharp
 services.AddRiftCache(options =>