diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index e90d0f3..1375fde 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -2,7 +2,12 @@
 #
 # Builds and pushes the three images to this instance's container registry
 # on every push to main: backend, frontend, and agent (which is built FROM
-# the backend image - see agent/Dockerfile - so it has to come after).
+# the backend image - see agent/Dockerfile - so it has to come after). Each
+# image gets both a ":latest" tag and a ":{APP_VERSION}" tag, the latter read
+# from backend/version.py (the single source of truth for the release
+# version) - self_update_service compares registry version *tags* against the
+# running APP_VERSION to decide whether an update is available, so without a
+# version tag it would never see one, no matter how far behind :latest is.
 #
 # Runs on ubuntu-latest, not the docker label: that label's image is a bare
 # docker:24-dind with no Node/bash, which breaks actions/checkout (a JS
@@ -26,19 +31,34 @@ jobs:
         with:
           token: ${{ secrets.CI_TOKEN }}
 
+      - name: Read app version
+        id: version
+        run: |
+          VERSION=$(grep -oP '(?<=APP_VERSION = ")[^"]+' backend/version.py)
+          echo "Building version $VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
       - name: Log in to the registry
         run: |
           echo "${{ secrets.CI_TOKEN }}" | docker login git.menzel.center -u menzeljonas --password-stdin
 
       - name: Build and push backend
         run: |
-          docker build -t "$REGISTRY/stackpilot-backend:latest" ./backend
+          docker build \
+            -t "$REGISTRY/stackpilot-backend:latest" \
+            -t "$REGISTRY/stackpilot-backend:${{ steps.version.outputs.version }}" \
+            ./backend
           docker push "$REGISTRY/stackpilot-backend:latest"
+          docker push "$REGISTRY/stackpilot-backend:${{ steps.version.outputs.version }}"
 
       - name: Build and push frontend
         run: |
-          docker build -t "$REGISTRY/stackpilot-frontend:latest" ./frontend
+          docker build \
+            -t "$REGISTRY/stackpilot-frontend:latest" \
+            -t "$REGISTRY/stackpilot-frontend:${{ steps.version.outputs.version }}" \
+            ./frontend
           docker push "$REGISTRY/stackpilot-frontend:latest"
+          docker push "$REGISTRY/stackpilot-frontend:${{ steps.version.outputs.version }}"
 
       # Uses the backend image just pushed above as its base (already in the
       # local Docker cache from that step, so this doesn't need to pull it).
@@ -47,5 +67,7 @@ jobs:
           docker build \
             --build-arg "BACKEND_IMAGE=$REGISTRY/stackpilot-backend:latest" \
             -t "$REGISTRY/stackpilot-agent:latest" \
+            -t "$REGISTRY/stackpilot-agent:${{ steps.version.outputs.version }}" \
             ./agent
           docker push "$REGISTRY/stackpilot-agent:latest"
+          docker push "$REGISTRY/stackpilot-agent:${{ steps.version.outputs.version }}"