diff --git a/.gitea/workflows/publish-public.yml b/.gitea/workflows/publish-public.yml
new file mode 100644
index 0000000..3f0e842
--- /dev/null
+++ b/.gitea/workflows/publish-public.yml
@@ -0,0 +1,103 @@
+name: Publish public images
+
+# Push the three node images to a PUBLIC registry on a version tag, so a fresh
+# Pi can `docker pull` them without a Gitea login (git.vpn.cusano.net is now
+# behind REQUIRE_SIGNIN_VIEW — see INCIDENT-2026-09-06). Source + the private
+# registry stay walled; only the built node images go public.
+#
+# ── DISABLED ────────────────────────────────────────────────────────────────
+# The job is gated on `vars.NODE_PUBLIC_PUBLISH == 'true'`. Until that repo
+# variable is set the workflow triggers on tags but the job is skipped, so
+# this file is wired and inert. We're still building the core; flip it on when
+# self-serve node install is actually needed.
+#
+# To enable:
+#   1. Repo → Settings → Actions → Variables:
+#        NODE_PUBLIC_PUBLISH = true
+#        PUBLIC_REGISTRY     = ghcr.io            (or docker.io)
+#        PUBLIC_NAMESPACE    = <org-or-user>      (images land at <ns>/drb-<name>)
+#   2. Repo → Settings → Actions → Secrets:
+#        PUBLIC_REGISTRY_USER   = <push user>
+#        PUBLIC_REGISTRY_TOKEN  = <push token / PAT with write:packages>
+#   3. Re-push a tag (or run this workflow via workflow_dispatch).
+# ---------------------------------------------------------------------------
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+concurrency:
+  group: publish-public-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  publish:
+    # Inert until the repo variable is set. Do NOT convert this to `if: false`
+    # — the variable is the switch, no code change needed to go live.
+    if: ${{ vars.NODE_PUBLIC_PUBLISH == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: edge-node
+            context: ./drb-edge-node
+            file: ./drb-edge-node/Dockerfile
+            cache_name: edge-node
+          - name: icecast
+            context: ./icecast
+            file: ./icecast/Dockerfile
+            cache_name: icecast
+          - name: op25-client
+            context: ./op25-container
+            file: ./op25-container/Dockerfile
+            cache_name: op25-client
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0   # need tags for `git describe`
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."git.vpn.cusano.net"]
+              http = false
+              insecure = false
+
+      # Private Gitea registry — read only, to reuse the existing build cache
+      # (keeps the op25 image off a ~1h from-scratch compile).
+      - uses: docker/login-action@v3
+        with:
+          registry: git.vpn.cusano.net
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.BUILD_TOKEN }}
+
+      # Public registry — where the images are pushed.
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ vars.PUBLIC_REGISTRY }}
+          username: ${{ secrets.PUBLIC_REGISTRY_USER }}
+          password: ${{ secrets.PUBLIC_REGISTRY_TOKEN }}
+
+      - name: Version
+        id: meta
+        run: |
+          echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
+          echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: ${{ matrix.context }}
+          file: ${{ matrix.file }}
+          platforms: linux/arm64
+          push: true
+          tags: |
+            ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:${{ steps.meta.outputs.VERSION }}
+            ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:latest
+          cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ matrix.cache_name }}:buildcache