diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..7dc19a4
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,48 @@
+name: Publish container image
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate image metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/techgodhq/rite
+          tags: |
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - name: Build and publish multi-architecture image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/README.md b/README.md
index b0dabfc..35cd665 100644
--- a/README.md
+++ b/README.md
@@ -43,6 +43,26 @@ Iris messages become `source = "iris"` events. `event_type` is the Iris message
 contains `provider`, `source_id`, `sender`, `kind`, `iris_metadata`, and the complete original
 Iris message under `message` for future matching needs.
 
+## Self-hosting with Docker
+
+Published images are available from GitHub Container Registry after a release tag:
+`ghcr.io/techgodhq/rite:<version>` (or `:latest`). Supply a webhook secret and,
+when Rite should subscribe to Iris events, its private Iris URL:
+
+```bash
+docker run --rm \
+  --name rite \
+  --publish 127.0.0.1:8080:8080 \
+  --env RITE_GITHUB_WEBHOOK_SECRET="${RITE_GITHUB_WEBHOOK_SECRET}" \
+  --env RITE_IRIS_BASE_URL="http://iris.internal:9876" \
+  ghcr.io/techgodhq/rite:latest
+```
+
+`RITE_GITHUB_WEBHOOK_SECRET` is required for authenticated GitHub webhook
+ingress. Omit `RITE_IRIS_BASE_URL` when you do not want an Iris subscription.
+For a complete private-network example with both services, use the Iris
+repository's [`deploy/docker-compose.yml`](https://github.com/TechGodHQ/iris/blob/main/deploy/docker-compose.yml).
+
 ## Development
 
 ```bash