diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 0f25cfa64..d7d45706e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -21,6 +21,9 @@ start_windows_vm:
   stage: build
   image: docker:27-cli
   rules:
+    - if: $CI_COMMIT_TAG =~ /^v/
+      when: manual
+      allow_failure: true
     - if: $CI_COMMIT_BRANCH == "main"
       when: manual
       allow_failure: true
@@ -31,6 +34,9 @@ stop_windows_vm:
   stage: package
   image: docker:27-cli
   rules:
+    - if: $CI_COMMIT_TAG =~ /^v/
+      when: manual
+      allow_failure: true
     - if: $CI_COMMIT_BRANCH == "main"
       when: manual
       allow_failure: true
@@ -40,6 +46,19 @@ stop_windows_vm:
 web:
   stage: build
   image: node:24-bullseye
+  rules:
+    # Release-Tags bauen immer (docker_web/desktop_* brauchen web als needs)
+    - if: $CI_COMMIT_TAG =~ /^v/
+    # Pushes nur, wenn build-relevante Pfade betroffen sind - Doku-Commits kosten nichts
+    - if: $CI_COMMIT_BRANCH
+      changes:
+        - apps/**/*
+        - packages/**/*
+        - patches/**/*
+        - scripts/**/*
+        - pnpm-lock.yaml
+        - pnpm-workspace.yaml
+        - .gitlab-ci.yml
   variables:
     NODE_OPTIONS: "--max-old-space-size=6144"
     CI_PACKAGE: "true"
@@ -65,14 +84,16 @@ docker_web:
     - job: web
       artifacts: false
   rules:
-    - if: $CI_COMMIT_BRANCH == "main"
+    # Nur bei Release-Tags (v*) - "releasen" ist ein bewusster Akt:
+    # Tag pushen -> Image entsteht -> Tag-Bump im gitops-Repo deployt es
+    - if: $CI_COMMIT_TAG =~ /^v/
   variables:
     IMAGE: rohana.axion1337.de/sorb/threadnet-web
     DOCKER_BUILDKIT: "1"
   script:
     - echo "$REGISTRY_PASSWORD" | docker login rohana.axion1337.de -u "$REGISTRY_USER" --password-stdin
-    - docker build -f apps/web/Dockerfile -t "$IMAGE:sha-$CI_COMMIT_SHORT_SHA" -t "$IMAGE:latest-ci" .
-    - docker push "$IMAGE:sha-$CI_COMMIT_SHORT_SHA"
+    - docker build -f apps/web/Dockerfile -t "$IMAGE:$CI_COMMIT_TAG" -t "$IMAGE:latest-ci" .
+    - docker push "$IMAGE:$CI_COMMIT_TAG"
     - docker push "$IMAGE:latest-ci"
 
 # Einmalig/selten: Build-Image fuer den Desktop-Build (rust:bullseye + node + tcl/sqlcipher,
@@ -93,8 +114,7 @@ desktop_image:
     - docker push "$IMAGE:bullseye"
 
 # Electron-Linux-Build (amd64, static sqlcipher) - repliziert den am 2026-07-29 manuell
-# verifizierten Build-Weg. Seit dem ersten gruenen Lauf (Job 322, 2026-07-31)
-# automatisch bei jedem Push auf main.
+# verifizierten Build-Weg. Automatisch bei Release-Tags, auf main manuell triggerbar.
 desktop_linux:
   stage: package
   image: rohana.axion1337.de/sorb/element-desktop-build:bullseye
@@ -102,7 +122,10 @@ desktop_linux:
     - job: web
       artifacts: true
   rules:
+    - if: $CI_COMMIT_TAG =~ /^v/
     - if: $CI_COMMIT_BRANCH == "main"
+      when: manual
+      allow_failure: true
   variables:
     MAX_GLIBC: "2.31"
     USE_HARD_LINKS: "false"
@@ -136,6 +159,9 @@ desktop_windows:
     - job: web
       artifacts: true
   rules:
+    - if: $CI_COMMIT_TAG =~ /^v/
+      when: manual
+      allow_failure: true
     - if: $CI_COMMIT_BRANCH == "main"
       when: manual
       allow_failure: true