diff --git a/.github/workflows/publish-baseline.yml b/.github/workflows/publish-baseline.yml
index ce79b2f..546d4f3 100644
--- a/.github/workflows/publish-baseline.yml
+++ b/.github/workflows/publish-baseline.yml
@@ -1,8 +1,10 @@
 name: Publish Baseline
 
-# Builds `trawl-baseline:latest` from `apps/api/Dockerfile.baseline` (Bun
-# baseline runtime — pre-2013-CPU compatible). Triggered manually, or
-# automatically on `baseline-v*` tags which also stamp `:baseline-vX.Y.Z`.
+# Builds the `:baseline` tag of `ghcr.io/.../trawl` from
+# `apps/api/Dockerfile.baseline` (Bun baseline runtime — pre-2013-CPU
+# compatible). Same GHCR package as `:latest`, just a different tag.
+# Triggered manually, or automatically on `baseline-v*` tags which stamp
+# `:baseline-vX.Y.Z`.
 
 on:
   workflow_dispatch:
@@ -10,7 +12,7 @@ on:
     tags: ["baseline-v*"]
 
 env:
-  IMAGE: ghcr.io/${{ github.repository_owner }}/trawl-baseline
+  IMAGE: ghcr.io/${{ github.repository_owner }}/trawl
 
 jobs:
   build:
@@ -41,14 +43,12 @@ jobs:
         shell: bash
         run: |
           if [[ "${{ github.event_name }}" == "push" ]]; then
-            # Tag push: publish the matching version tag + baseline-vX.Y.Z
             VER="${GITHUB_REF_NAME#baseline-v}"
-            echo "version=${VER}" >> "$GITHUB_OUTPUT"
             TAGS="${IMAGE}:baseline-v${VER}"
           else
-            # Manual dispatch: only update :latest if on default branch
+            # Manual dispatch: only update :baseline if on default branch
             if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
-              TAGS="${IMAGE}:latest"
+              TAGS="${IMAGE}:baseline"
             else
               TAGS=""
             fi
@@ -65,9 +65,17 @@ jobs:
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.tags.outputs.tags }}
           labels: |
-            org.opencontainers.image.title=trawl-baseline
+            org.opencontainers.image.title=trawl (baseline tag)
             org.opencontainers.image.description=TRAWL API on Bun baseline runtime
           cache-from: type=gha,scope=trawl-baseline-${{ matrix.platform }}
           cache-to: type=gha,scope=trawl-baseline-${{ matrix.platform }},mode=max
           secrets: |
             GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+
+      # Safety: prevent the baseline workflow from ever stamping :latest.
+      # Builds tagged `:latest` are owned by publish.yml.
+      - name: Guard against :latest tag
+        if: startsWith(steps.tags.outputs.tags, 'ghcr.io/') && endsWith(steps.tags.outputs.tags, ':latest')
+        run: |
+          echo "::error::Baseline workflow must not push :latest — aborting"
+          exit 1
diff --git a/README.md b/README.md
index d1babbc..bd293b4 100644
--- a/README.md
+++ b/README.md
@@ -94,24 +94,24 @@ Tier 4: Residential proxy ──── success ──→ cache + return (15–45
 | `docker-compose.prod.yml`    | Production: `restart: always`, memory limit, healthcheck |
 | `docker-compose.full.yml`    | Full stack: scraper + web + docs                         |
 
-## Docker images (two GHCR images)
+## Docker images (one GHCR package, two tags)
 
-| Image                                          | Dockerfile                       | Runtime                          | Use case |
-|------------------------------------------------|----------------------------------|----------------------------------|----------|
-| `ghcr.io/germondai/trawl`         (`:latest`)  | `apps/api/Dockerfile`            | Bun 1.3.14 (modern, AVX2)        | Default — modern Linux amd64/arm64 |
-| `ghcr.io/germondai/trawl-baseline` (`:baseline`) | `apps/api/Dockerfile.baseline`   | Bun 1.3.14 baseline (no AVX2)     | Older CPUs / older kernels (Synology NAS, J4125, Atom-era) |
+| Image tag                              | Built from                      | Runtime                          | Use case |
+|----------------------------------------|--------------------------------|----------------------------------|----------|
+| `ghcr.io/germondai/trawl:latest`       | `apps/api/Dockerfile`           | Bun 1.3.14 (modern, AVX2)        | Default — modern Linux amd64/arm64 |
+| `ghcr.io/germondai/trawl:baseline`     | `apps/api/Dockerfile.baseline`  | Bun 1.3.14 baseline (no AVX2)     | Older CPUs / older kernels (Synology NAS, J4125, Atom-era) |
 
-Two images live at separate GHCR packages so `:latest` of one cannot clobber `:latest` of another. Pick the one your hardware supports:
+Both tags live on the same `ghcr.io/germondai/trawl` package — they share the registry but use different Dockerfile sources. Pick whichever tag fits your hardware:
 
 ```yaml
 # Modern hardware (most users)
 image: ghcr.io/germondai/trawl:latest
 
 # Older CPUs without AVX2 / Synology / older kernels
-image: ghcr.io/germondai/trawl-baseline:latest
+image: ghcr.io/germondai/trawl:baseline
 ```
 
-Synology note: many Synology NAS units (DSM 7.x on J4125 / older hardware) ship kernel 4.4.x, which Bun's modern runtime can't fully handle. The baseline variant is published for that case — confirm-working status on the reporter's actual hardware (DS920+, kernel 4.4.302) is pending verification. Published by independent GitHub Actions workflows (`.github/workflows/publish.yml`, `publish-baseline.yml`); tag-triggered releases (`v*`, `baseline-v*`) and manual `workflow_dispatch` both work.
+Synology note: many Synology NAS units (DSM 7.x on J4125 / older hardware) ship kernel 4.4.x, which Bun's modern runtime can't fully handle. The `:baseline` tag is published for that case — confirm-working status on the reporter's actual hardware (DS920+, kernel 4.4.302) is pending verification. Published by independent GitHub Actions workflows (`.github/workflows/publish.yml`, `publish-baseline.yml`); tag-triggered releases (`v*`, `baseline-v*`) and manual `workflow_dispatch` both work.
 
 ## Configuration