diff --git a/.github/workflows/web-docker.yml b/.github/workflows/web-docker.yml
index 151f07bb490..22b49925093 100644
--- a/.github/workflows/web-docker.yml
+++ b/.github/workflows/web-docker.yml
@@ -7,7 +7,7 @@ on:
       - 'flutter/lib/**'
       - 'flutter/assets/**'
       - 'flutter/pubspec.*'
-      - 'Dockerfile.webclient'
+      - 'deploy/docker/webclient/Dockerfile'
       - '.github/workflows/web-docker.yml'
       - '.github/patches/flutter_3.24.4_dropdown_menu_enableFilter.diff'
   push:
@@ -15,8 +15,7 @@ on:
   workflow_dispatch:
 
 env:
-  REGISTRY: ghcr.io
-  IMAGE_NAME: ${{ github.repository_owner }}/rustdesk-webclient
+  IMAGE_NAME: rophy/rustdesk-webclient
 
 jobs:
   test:
@@ -51,7 +50,6 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: read
-      packages: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -62,19 +60,18 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to GHCR
+      - name: Log in to Docker Hub
         if: startsWith(github.ref, 'refs/tags/')
         uses: docker/login-action@v3
         with:
-          registry: ${{ env.REGISTRY }}
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          images: ${{ env.IMAGE_NAME }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
@@ -83,9 +80,18 @@ jobs:
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: Dockerfile.webclient
+          file: deploy/docker/webclient/Dockerfile
           push: ${{ startsWith(github.ref, 'refs/tags/') }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
+
+      - name: Update Docker Hub description
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: peter-evans/dockerhub-description@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: ${{ env.IMAGE_NAME }}
+          readme-filepath: deploy/docker/webclient/README.md
diff --git a/Dockerfile.webclient b/deploy/docker/webclient/Dockerfile
similarity index 100%
rename from Dockerfile.webclient
rename to deploy/docker/webclient/Dockerfile
diff --git a/deploy/docker/webclient/README.md b/deploy/docker/webclient/README.md
new file mode 100644
index 00000000000..2beaf9cc34e
--- /dev/null
+++ b/deploy/docker/webclient/README.md
@@ -0,0 +1,42 @@
+# RustDesk Web Client
+
+OSS-compatible web client for [RustDesk](https://rustdesk.com) remote desktop, built from the official Flutter web source with patches for hbbs/hbbr (non-Pro) servers.
+
+## Quick Start
+
+```bash
+docker run -d -p 8080:80 \
+  -e RUSTDESK_HOST=wss://your-server.com/hbbs \
+  -e RUSTDESK_RELAY=wss://your-server.com/hbbr \
+  -e RUSTDESK_KEY=your-public-key \
+  rophy/rustdesk-webclient
+```
+
+Then open http://localhost:8080 in a browser.
+
+## Environment Variables
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `RUSTDESK_HOST` | Yes | WebSocket URL of the rendezvous server (hbbs) |
+| `RUSTDESK_RELAY` | No | WebSocket URL of the relay server (hbbr). Defaults to `RUSTDESK_HOST` |
+| `RUSTDESK_KEY` | No | Server public key |
+| `RUSTDESK_API` | No | API server URL (only for Server Pro) |
+
+## With Reverse Proxy
+
+When running behind a reverse proxy (nginx, Istio, etc.) that terminates TLS:
+
+```bash
+docker run -d -p 8080:80 \
+  -e RUSTDESK_HOST=wss://rustdesk.example.com/hbbs \
+  -e RUSTDESK_RELAY=wss://rustdesk.example.com/hbbr \
+  -e RUSTDESK_KEY=your-public-key \
+  rophy/rustdesk-webclient
+```
+
+The proxy should route `/hbbs` to hbbs port 21118 and `/hbbr` to hbbr port 21119 with WebSocket upgrade support.
+
+## Source
+
+Built from [rophy/rustdesk](https://github.com/rophy/rustdesk) using [`deploy/docker/webclient/Dockerfile`](https://github.com/rophy/rustdesk/blob/master/deploy/docker/webclient/Dockerfile).