diff --git a/.dockerignore b/.dockerignore
index 06b6abd8d5..efd67aba24 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -8,3 +8,5 @@ node_modules
 .env.local
 .env*.local
 *.log
+*.tsbuildinfo
+**/*.tsbuildinfo
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c6d95cb11d..e8b811cc36 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -421,6 +421,9 @@ jobs:
         with:
           context: .
           platforms: linux/${{ matrix.arch }}
+          labels: |
+            org.opencontainers.image.version=${{ needs.release.outputs.version }}
+            org.opencontainers.image.revision=${{ github.sha }}
           outputs: type=image,name=ghcr.io/pascalorg/pascal-editor,push-by-digest=true,name-canonical=true,push=true
 
       - run: |
diff --git a/Dockerfile b/Dockerfile
index 0e609316e3..7bd44336d4 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -23,6 +23,16 @@ RUN cd packages/cli && bun run build && bun run stage-runtime
 
 FROM node:22-alpine
 WORKDIR /app
+
+# GHCR reads these: the package page links to the repository, shows its
+# README and inherits its access, and the licence is declared on the image.
+LABEL org.opencontainers.image.title="Pascal editor" \
+      org.opencontainers.image.description="Self-hosted Pascal, the open-source 3D architecture editor: one container, projects in SQLite under /data." \
+      org.opencontainers.image.source="https://github.com/pascalorg/editor" \
+      org.opencontainers.image.documentation="https://github.com/pascalorg/editor/blob/main/SETUP.md" \
+      org.opencontainers.image.url="https://editor.pascal.app" \
+      org.opencontainers.image.vendor="Pascal" \
+      org.opencontainers.image.licenses="MIT"
 ENV NODE_ENV=production \
     HOSTNAME=0.0.0.0 \
     PORT=3000 \
diff --git a/README.md b/README.md
index dd59648ade..02597fa3e4 100644
--- a/README.md
+++ b/README.md
@@ -62,6 +62,23 @@ troubleshooting.
 
 Use one active agent client per local CLI service. The standalone local HTTP runtime shares active scene state between clients; use separate `PASCAL_HOME` directories and service processes when independent concurrent work is required.
 
+## Self-host it
+
+The editor ships as one container, `ghcr.io/pascalorg/pascal-editor`, tagged with the
+same version as the npm packages (`latest` follows stable releases). Projects live in
+SQLite under `/data`; one admin password protects the instance; `PASCAL_PUBLIC_URL` is
+read at runtime, so the same image serves any domain.
+
+```bash
+docker run -d -p 3000:3000 -v pascal-data:/data \
+  -e PASCAL_ADMIN_PASSWORD=change-me \
+  -e PASCAL_PUBLIC_URL=https://pascal.example.com \
+  ghcr.io/pascalorg/pascal-editor:latest
+```
+
+See [SETUP.md, "Self-hosting"](SETUP.md#self-hosting) for the compose file, the
+variables, agent access and public embeds.
+
 ## Agent skills
 
 [![Install with skills](https://skills.sh/b/pascalorg/editor)](https://skills.sh/pascalorg/editor)