diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index fda07af..a3e7f2c 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -1,12 +1,20 @@
 # Tag-triggered release workflow.
-# Generates changelog and creates Forgejo release on v* tags.
-# Copied from Circuit-Forge/cf-agents workflows/release.yml
+# Generates changelog, publishes Docker images to GHCR, and creates Forgejo release.
 #
-# Docker push is intentionally disabled — BSL 1.1 registry policy not yet resolved.
-# Tracked in Circuit-Forge/cf-agents#3. Re-enable the Docker steps when that lands.
+# Images published on v* tags:
+#   ghcr.io/circuitforgellc/peregrine:latest        — FastAPI API (includes cf-orch)
+#   ghcr.io/circuitforgellc/peregrine:<tag>
+#   ghcr.io/circuitforgellc/peregrine-web:latest    — Vue SPA (base path /)
+#   ghcr.io/circuitforgellc/peregrine-web:<tag>
 #
-# Required secrets: FORGEJO_RELEASE_TOKEN
-# (GHCR_TOKEN not needed until Docker push is enabled)
+# The cloud image (compose.cloud.yml) is never published — it is built and
+# deployed directly on Heimdall from Dockerfile.cfcore with sibling repos.
+#
+# Required secrets:
+#   FORGEJO_RELEASE_TOKEN    — Forgejo API token for creating releases
+#   GH_GHCR_TOKEN            — GitHub PAT with packages:write for GHCR push
+#   FORGEJO_CF_ORCH_TOKEN    — Forgejo token to install private circuitforge-orch
+#                              during the API image build (BSL client for paid tier)
 
 name: Release
 
@@ -32,28 +40,56 @@ jobs:
         env:
           OUTPUT: CHANGES.md
 
-      # ── Docker (disabled — BSL registry policy pending cf-agents#3) ──────────
-      # - name: Set up QEMU
-      #   uses: docker/setup-qemu-action@v3
-      # - name: Set up Buildx
-      #   uses: docker/setup-buildx-action@v3
-      # - name: Log in to GHCR
-      #   uses: docker/login-action@v3
-      #   with:
-      #     registry: ghcr.io
-      #     username: ${{ github.actor }}
-      #     password: ${{ secrets.GHCR_TOKEN }}
-      # - name: Build and push Docker image
-      #   uses: docker/build-push-action@v6
-      #   with:
-      #     context: .
-      #     push: true
-      #     platforms: linux/amd64,linux/arm64
-      #     tags: |
-      #       ghcr.io/circuitforgellc/peregrine:${{ github.ref_name }}
-      #       ghcr.io/circuitforgellc/peregrine:latest
-      #     cache-from: type=gha
-      #     cache-to: type=gha,mode=max
+      # ── Docker setup ─────────────────────────────────────────────────────────
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GH_GHCR_TOKEN }}
+
+      # ── API image ─────────────────────────────────────────────────────────────
+      # cf-orch (BSL, private) is installed via BuildKit secret — token never
+      # appears in any image layer. Community builds without the secret fall back
+      # to local backends automatically.
+      - name: Build and push API image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          dockerfile: Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          secrets: |
+            forgejo_token=${{ secrets.FORGEJO_CF_ORCH_TOKEN }}
+          tags: |
+            ghcr.io/circuitforgellc/peregrine:${{ github.ref_name }}
+            ghcr.io/circuitforgellc/peregrine:latest
+          cache-from: type=gha,scope=api
+          cache-to: type=gha,mode=max,scope=api
+
+      # ── Web image ─────────────────────────────────────────────────────────────
+      # Published with VITE_BASE_PATH=/ (self-hosted default).
+      # Cloud and demo deployments build locally with VITE_BASE_PATH=/peregrine/.
+      - name: Build and push web image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          dockerfile: docker/web/Dockerfile
+          push: true
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            VITE_BASE_PATH=/
+          tags: |
+            ghcr.io/circuitforgellc/peregrine-web:${{ github.ref_name }}
+            ghcr.io/circuitforgellc/peregrine-web:latest
+          cache-from: type=gha,scope=web
+          cache-to: type=gha,mode=max,scope=web
 
       # ── Forgejo Release ───────────────────────────────────────────────────────
       - name: Create Forgejo release