diff --git a/.drone.yml b/.drone.yml
index d34cf48..0046870 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -51,6 +51,22 @@ steps:
       event:
         - pull_request
 
+  # plugins/docker reads its tag list from a .tags file when no "tags"
+  # setting is given. Master images get latest, the commit SHA and the
+  # release version from changelog-beta.md, so a release can be pulled by name.
+  - name: image-tags
+    image: cache.coadcorp.com/library/golang:1.27.1
+    commands:
+      - XTEVE_VERSION="$(grep -m1 '^#### ' changelog-beta.md | cut -d' ' -f2 | sed 's/-beta$//')"
+      - test -n "$XTEVE_VERSION"
+      - printf '%s' "latest,${DRONE_COMMIT_SHA},$XTEVE_VERSION" > .tags
+      - cat .tags
+    when:
+      event:
+        - push
+      branch:
+        - master
+
   - name: docker-publish
     image: plugins/docker
     environment:
@@ -63,9 +79,6 @@ steps:
       username: nathan
       password:
         from_secret: registry_password
-      tags:
-        - latest
-        - ${DRONE_COMMIT_SHA}
       build_args:
         - TARGETOS=linux
         - TARGETARCH=amd64
diff --git a/README-DEV.md b/README-DEV.md
index 748eab2..eaf559b 100644
--- a/README-DEV.md
+++ b/README-DEV.md
@@ -53,7 +53,7 @@ Add `-dev` to serve the web interface from the local `html/` directory instead o
 
 The version lives in two places that must agree: `var Version` in `xteve.go` and the first `#### ` heading in `changelog-beta.md` (without the `-beta` suffix). CI fails on drift.
 
-Drone (`.drone.yml`) runs vet, tests, the bundle check, hadolint and compose validation on every push. Pushes to `master` publish `registry.coadcorp.com/nathan/xteve:latest` and `:<sha>`; other branches publish `:<branch>` and `:<sha>`.
+Drone (`.drone.yml`) runs vet, tests, the bundle check, hadolint and compose validation on every push. Pushes to `master` publish `registry.coadcorp.com/nathan/xteve:latest`, `:<version>` and `:<sha>`; other branches publish `:<branch>` and `:<sha>`.
 
 ## Endpoints useful for operations
 
diff --git a/README.md b/README.md
index 9810401..901ecad 100644
--- a/README.md
+++ b/README.md
@@ -74,7 +74,7 @@ registry.coadcorp.com/nathan/xteve
 
 Tags:
 
-* `latest` and `<commit sha>` from the `master` branch.
+* `latest`, the release version (for example `2.3.0.0202`) and `<commit sha>` from the `master` branch. Pin the version tag if you want to control when you upgrade, or to roll back.
 * `<branch name>` and `<commit sha>` from every other branch.
 
 ```bash
diff --git a/changelog-beta.md b/changelog-beta.md
index 3147fb2..17e8e97 100644
--- a/changelog-beta.md
+++ b/changelog-beta.md
@@ -1,3 +1,20 @@
+#### 2.3.0.0202-beta
+```diff
++ Security: provider-supplied text is rendered as text in the web UI; websocket requests must come from the same origin; the session cookie is HttpOnly and SameSite=Strict; logo uploads, backup restores, the ffmpeg/VLC path and stream URLs are validated; backups can only be downloaded with a web session.
++ Passwords are stored with bcrypt. Existing accounts are upgraded on their next login.
++ Streaming: buffer state rewritten around a single lock with an atomic tuner limit; ffmpeg/VLC are stopped when the last client leaves or when no data arrives within 20 seconds; long streams no longer accumulate open handles.
++ Per-playlist buffer choice (default, none, xTeVe, FFmpeg, VLC) in the playlist dialog.
++ New filter type: regular expression.
++ Web UI: one persistent websocket with automatic reconnect, light theme following the OS setting, focus is kept when the menu refreshes, errors are announced to screen readers.
++ The web interface is embedded with go:embed and built from a pinned TypeScript toolchain; the language file is gone (English only).
++ New /healthz endpoint, used by the container healthcheck.
++ Container: PUID/PGID are applied at start-up; ffmpeg 9.0.2; images are also tagged with the release version.
++ Settings and other state files are written atomically; settings.json is readable by the owner only.
++ HTTP server and provider downloads have timeouts.
+- Removed the built-in self-updater. Updates are delivered through the container image.
+- Removed XTEVE_UID/XTEVE_GID as the documented variables (still accepted as a fallback for PUID/PGID).
+```
+
 #### 2.2.0.0201-beta
 Add UI enhancement for range selecting checkboxes
 
diff --git a/tasks/todo.md b/tasks/todo.md
index 173f2a3..334861f 100644
--- a/tasks/todo.md
+++ b/tasks/todo.md
@@ -47,7 +47,7 @@ Status: all phases done on branch `improvements` (2026-09-26). Open: the `agent.
 - [x] i18n dropped: 254 placeholders inlined, `en.json` deleted, only HTML pages templated (`authenticationErr`)
 - [x] `package.json` + `ts/tsconfig.json` (tsc 5.9.3, ES2020, single outFile `html/js/app.js`, committed, CI-verified); 10 dead JS files deleted; 6 tsc errors fixed incl. a real ASI bug in the search shortcut
 - [x] CI: vet, gofmt check, staticcheck v0.8.1 (config in `staticcheck.conf`), bundle freshness check. `go test -race` still to add once tests exist
-- [ ] Version-tagged images (amd64 only)
+- [x] Version-tagged images: master publishes `latest`, the commit SHA and the changelog version via a `.tags` file (amd64 only)
 - [x] PUID/PGID via su-exec at runtime; static-ffmpeg pinned to 7.1.1; `VOLUME /xteve/config`; `/xteve` removed from `LEGACY_CONFIG_DIRS`; compose files pull from the registry and document SSDP/host networking
 - [x] `/healthz` endpoint; Dockerfile healthcheck uses it
 - [x] `README-DEV.md` and fork-specific `README.md` (about, container usage, env vars, security notes)
diff --git a/xteve.go b/xteve.go
index 3877b93..c193650 100644
--- a/xteve.go
+++ b/xteve.go
@@ -23,7 +23,7 @@ const Name = "xTeVe"
 
 // Version : Version, die Build Nummer wird in der main func geparst.
 // Can be overwritten at build time: -ldflags "-X main.Version=..."
-var Version = "2.2.0.0201"
+var Version = "2.3.0.0202"
 
 // DBVersion : Datanbank Version
 const DBVersion = "2.1.0"