diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d5b5aee..5ce96ce 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -1,4 +1,5 @@
-# Tests the catalog and builds t5de-catalog for Linux (static) and its Docker image.
+# Tests the catalog and builds t5de-catalog for Linux (static); then, for main and vX.Y.Z tags, builds its image and
+# pushes it to git.t5de.dev. Komodo deploys it (dhkatz/infra); CI never deploys.
 name: CI
 
 on:
@@ -35,3 +36,34 @@ jobs:
             -ldflags "-s -w -buildid= -X git.t5de.dev/t5de/t5de-catalog/internal/buildinfo.Version=${GITHUB_SHA::12}" \
             -o dist/t5de-catalog ./cmd/t5de-catalog
           sha256sum dist/t5de-catalog
+
+  # main → :latest-main and :main-<commit>; vX.Y.Z → :X.Y.Z, :X.Y and :latest. Built by the runner's Docker; the build
+  # fetches T5DE's Go modules from git.t5de.dev at the address the runner gives this job.
+  image:
+    needs: build
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build and push
+        env:
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+          IMAGE: git.t5de.dev/t5de/t5de-catalog
+        run: |
+          case "$GITHUB_REF" in
+            refs/heads/main) version="main-${GITHUB_SHA::12}"; tags="latest-main $version" ;;
+            refs/tags/v*)
+              version="${GITHUB_REF#refs/tags/v}"
+              [[ "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { echo "Not a vX.Y.Z tag: no image"; exit 0; }
+              tags="$version ${version%.*} latest" ;;
+            *) echo "Not main or a tag: no image"; exit 0 ;;
+          esac
+          git_ip=$(getent ahostsv4 git.t5de.dev | awk '{print $1; exit}')
+          echo "$REGISTRY_TOKEN" | docker login git.t5de.dev -u deploy --password-stdin
+          docker build --add-host "git.t5de.dev:$git_ip" --build-arg VERSION="$version" \
+            --label org.opencontainers.image.source="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
+            --label org.opencontainers.image.revision="$GITHUB_SHA" --label org.opencontainers.image.version="$version" \
+            $(for t in $tags; do echo "-t $IMAGE:$t"; done) .
+          for t in $tags; do docker push -q "$IMAGE:$t"; done
+          docker logout git.t5de.dev