diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index dc74c85..ddf456f 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -51,12 +51,14 @@ jobs:
     strategy:
       matrix:
         release:
+          # `latest` must always stay on the newest stable release entry
           - version: "8.2.0"
             dir: "v8"
             trivy-ignore: "v8/8.2/.trivyignore"
             extra-tags: |
               8.2
               8
+              latest
           - version: "8.1.0"
             dir: "v8"
             trivy-ignore: "v8/8.1/.trivyignore"
diff --git a/README.md b/README.md
index a9f1d76..d2ede56 100644
--- a/README.md
+++ b/README.md
@@ -14,17 +14,20 @@ Docker image for [ownCloud Infinite Scale (oCIS)](https://github.com/owncloud/oc
 docker run --rm \
   -p 9200:9200 \
   -e OCIS_INSECURE=true \
-  owncloud/ocis:8.1.0
+  owncloud/ocis:8.2.0
 ```
 
 ## Supported Tags
 
 | Tag | oCIS Version |
 |-----|-------------|
-| `8.2.0-rc.1` | 8.2.0-rc.1 (release candidate — exact tag only, no floating tags) |
-| `8.1.0`, `8.1`, `8` | 8.1.0 (latest stable) |
-| `8.0.5`, `8.0` | 8.0.5 |
-| `<version>-YYYYMMDD` | Immutable per-build tag (e.g. `8.1.0-20260703`) |
+| `latest`, `8.2.0`, `8.2`, `8` | 8.2.0 (latest stable) |
+| `8.1.0`, `8.1` | 8.1.0 |
+| `8.0.7`, `8.0` | 8.0.7 |
+| `<version>-YYYYMMDD` | Immutable per-build tag (e.g. `8.2.0-20260819`) |
+
+> **Note:** `latest` always points to the newest stable release. For production
+> deployments, pin a specific version tag instead.
 
 ## Rolling Image