diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 85db48e..0771e2e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -36,17 +36,50 @@ jobs:
       - name: "Test image"
         run: "make test"
 
+  version:
+    name: "Version"
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Read VERSION
+        id: version
+        run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"
+
   build:
     name: "Build"
-    needs: ["test"]
+    needs: ["test", "version"]
+    strategy:
+      fail-fast: false
+      matrix:
+        tag: ["latest", "${{ needs.version.outputs.version }}"]
     if: github.ref == 'refs/heads/master'
     uses: dockette/.github/.github/workflows/docker.yml@master
     secrets: inherit
     with:
       image: "dockette/varnish"
-      tag: "latest"
+      tag: ${{ matrix.tag }}
       context: "."
 
+  release:
+    name: "Release"
+    needs: build
+    if: github.ref == 'refs/heads/master' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release view "$(cat VERSION)" || gh release create "$(cat VERSION)" --generate-notes
+
   docs:
     name: "Docs"
     needs: ["build"]
diff --git a/AGENTS.md b/AGENTS.md
index a1339fe..c29fea8 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -32,3 +32,4 @@ Dockette Varnish builds `dockette/varnish`, a legacy Varnish Cache image for old
 - Place `.PHONY: <target>` directly above each Makefile target.
 - Keep README badges and maintenance sections consistent with other Dockette image repos.
 - Do not introduce unrelated modernization or runtime behavior changes.
+- `VERSION` is the release date; `make release` bumps it. CI pushes `latest` also as `<VERSION>` and creates the GitHub release.
diff --git a/Makefile b/Makefile
index ba07e84..61cca95 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,7 @@
 DOCKER_IMAGE=dockette/varnish
 DOCKER_TAG?=latest
 DOCKER_PLATFORMS?=linux/amd64,linux/arm64
+VERSION:=$(shell cat VERSION)
 
 .PHONY: build
 build:
@@ -18,3 +19,13 @@ run:
 	docker network create varnish-run >/dev/null 2>&1 || true
 	docker run --rm -d --name varnish-app --network varnish-run --network-alias app nginx:alpine
 	docker run --rm -it -p 80:80 --network varnish-run ${DOCKER_IMAGE}:${DOCKER_TAG}; status=$$?; docker stop varnish-app >/dev/null; exit $$status
+
+.PHONY: version
+version:
+	@echo ${VERSION}
+
+.PHONY: release
+release:
+	@date -u +%Y.%m.%d > VERSION
+	@echo "VERSION: ${VERSION} -> $$(cat VERSION)"
+	@echo "next: git commit -am \"Release: $$(cat VERSION)\" && git push"
diff --git a/README.md b/README.md
index 60207a8..693c94a 100644
--- a/README.md
+++ b/README.md
@@ -48,12 +48,19 @@ This repository intentionally preserves the historical image behavior. The entry
 
 The CI smoke test focuses on build viability, Varnish version output, entrypoint presence, bundled config presence, and VCL compilation.
 
+## Versions
+
+The release version is the date in [`VERSION`](VERSION). CI pushes `latest` also as `dockette/varnish:<VERSION>`.
+To release, run `make release`, commit and push to `master`.
+
 ## Development
 
 ```bash
 make build
 make test
 make run
+make version
+make release
 ```
 
 `make run` starts a temporary backend as `app:80` for the bundled VCL.
diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..7387f12
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+2026.10.23