diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 956541f..0816eb2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,6 +3,7 @@ name: Build and push container
 on:
   push:
     branches: [ main ]
+    tags: [ '*' ]
 
 env:
   REGISTRY: ghcr.io
@@ -28,6 +29,8 @@ jobs:
 
     - name: Build and push
       run: bin/build.sh
+      env:
+        TAG: ${{ github.ref_name }}
 
     - name: Build Summary
       if: always()
diff --git a/README.md b/README.md
index 4cc14d7..d479296 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,19 @@ Deployment will eventually be automatic, but in the meantime, the infrastructure
 
 To ignore files from deployment, specify them in `.distignore`.
 
+**Notes for the infrastructure team:**
+
+```
+# In this repo (fairpm/server)
+git checkout main
+git tag -f production
+git push --tags
+
+# Then in the fairpm/infrastructure-private repo
+./jazz
+cd helm/projects/site
+bin/deploy production
+```
 
 ## License
 
diff --git a/bin/build.sh b/bin/build.sh
index 2e78129..4939ec4 100755
--- a/bin/build.sh
+++ b/bin/build.sh
@@ -40,9 +40,15 @@ if [ $? -ne 0 ]; then
 	exit 1
 fi
 
+extra_tag=''
+[[ -n ${TAG:-} ]] && extra_tag="--tag ghcr.io/fairpm/server:${TAG}"
+
 echo "Building image…" >&2
+
+# shellcheck disable=SC2086
 docker build \
 	--tag ghcr.io/fairpm/server:latest \
+	$extra_tag \
 	--build-context src="$BUILD_DIR" \
 	"$SCRIPT_DIR/container"