diff --git a/.github/workflows/build-and-publish.yml b/.github/workflows/build-and-publish.yml
index 936e0793..ad9c8df3 100644
--- a/.github/workflows/build-and-publish.yml
+++ b/.github/workflows/build-and-publish.yml
@@ -1,5 +1,5 @@
-# Builds + publishes container images to ghcr.io with `:latest`,
-# `:<sha>`, and release tags. Cluster rollout is handled out-of-band: Keel polls
+# Builds + publishes container images to ghcr.io with `:latest` and
+# `:<sha>` tags. Cluster rollout is handled out-of-band: Keel polls
 # ghcr every 2 minutes and rolls the matching Deployment when the
 # `:latest` digest changes, while Flux reconciles manifest changes
 # from `main`. Neither is this workflow's responsibility — the name
@@ -9,7 +9,6 @@ name: Build & Publish
 on:
   push:
     branches: [main]
-    tags: ['v*.*.*']
   # Manual trigger for the cases where a push event never fires the
   # workflow (rare GitHub oddity — observed once with the `#308`
   # merge: workflow silently absent for that SHA) or where a merge
@@ -53,7 +52,7 @@ jobs:
       - uses: dorny/paths-filter@v4.0.1
         id: filter
         with:
-          base: ${{ github.ref_type == 'tag' && github.sha || github.event.before }}
+          base: ${{ github.event.before }}
           filters: |
             workflow:
               - '.github/workflows/build-and-publish.yml'
@@ -137,8 +136,11 @@ jobs:
           #
           # Multi-arch is gated on `main` only. The arm64 leg builds under
           # QEMU emulation and roughly doubles the UI build time; we don't
-          # want to pay that on every reconcile, dispatch, or release-tag
-          # trigger; feature branches and tags still build amd64-only.
+          # want to pay that on every reconcile / dispatch / future trigger
+          # that someone might add. Today the workflow's `on:` only fires
+          # for push to main, but this guard makes the intent explicit and
+          # forward-safe — if you add workflow_dispatch later, feature
+          # branches still build amd64-only.
           AMD64=linux/amd64
           if [[ "${{ github.ref }}" == "refs/heads/main" && "${{ github.event_name }}" == "push" ]]; then
             UI_PLATFORMS=linux/amd64,linux/arm64
@@ -148,12 +150,8 @@ jobs:
           fi
 
           # `force_all=true` on workflow_dispatch overrides every
-          # per-service filter so all images rebuild in one go. Release tags
-          # also rebuild every service so each image gets the version tag.
+          # per-service filter so all images rebuild in one go.
           FORCE_ALL="${{ github.event.inputs.force_all || 'false' }}"
-          if [[ "$GITHUB_REF_TYPE" == "tag" && "$GITHUB_REF_NAME" == v*.*.* ]]; then
-            FORCE_ALL=true
-          fi
 
           [[ "$(any "$FORCE_ALL" "$KOTLIN_SHARED"   "$FILTER_AUTH_API")"      == "true" ]] && append auth-api      services/auth-api/Dockerfile      "$AMD64"
           [[ "$(any "$FORCE_ALL" "$KOTLIN_SHARED"   "$FILTER_ASSISTANT_API")" == "true" ]] && append assistant-api services/assistant-api/Dockerfile "$AMD64"
@@ -199,14 +197,6 @@ jobs:
       - uses: actions/checkout@v6.0.2
       - name: Set image prefix (lowercase)
         run: echo "IMAGE_PREFIX=$(echo '${{ github.repository }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
-      - name: Compute release version
-        id: release-version
-        run: |
-          if [[ "$GITHUB_REF_TYPE" == "tag" && "$GITHUB_REF_NAME" == v*.*.* ]]; then
-            echo "version=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
-          else
-            echo "version=" >> "$GITHUB_OUTPUT"
-          fi
       # QEMU is only needed when a service builds for a non-runner arch
       # (the UIs build linux/arm64 alongside amd64). No-op for the
       # amd64-only JVM services.
@@ -235,6 +225,5 @@ jobs:
           tags: |
             ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.service.name }}:${{ github.sha }}
             ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.service.name }}:latest
-            ${{ steps.release-version.outputs.version && format('{0}/{1}/{2}:{3}', env.REGISTRY, env.IMAGE_PREFIX, matrix.service.name, steps.release-version.outputs.version) || '' }}
           cache-from: type=gha,scope=${{ matrix.service.name }}
           cache-to: type=gha,mode=max,scope=${{ matrix.service.name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 613855a9..00000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Release
-
-on:
-  push:
-    branches: [main]
-
-permissions:
-  contents: write
-  pull-requests: write
-
-concurrency:
-  group: release-please
-  cancel-in-progress: false
-
-jobs:
-  release:
-    name: Release Please
-    runs-on: ubuntu-latest
-    steps:
-      - uses: googleapis/release-please-action@v4
-        with:
-          config-file: release-please-config.json
-          manifest-file: .release-please-manifest.json
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
deleted file mode 100644
index 466df71c..00000000
--- a/.release-please-manifest.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  ".": "0.1.0"
-}
diff --git a/docs/runbooks/versioned-deploy.md b/docs/runbooks/versioned-deploy.md
deleted file mode 100644
index a928e092..00000000
--- a/docs/runbooks/versioned-deploy.md
+++ /dev/null
@@ -1,36 +0,0 @@
-# Versioned Deploy Model
-
-Production deploys are driven by explicit version pins in Git, not by pushes to
-`main` or mutable `:latest` tags.
-
-## Target Model
-
-- `main` is the integration branch. Merging to `main` does not by itself define
-  the production version.
-- release-please creates release tags in the form `vX.Y.Z`.
-- `build-and-publish` publishes in-house container images with version tags that
-  match the release tag.
-- A release PR bumps explicit image tags under `platform/cluster/flux/**` from
-  the previous version to the new version.
-- Flux deploys the commit that pins those image tags.
-- Rollback is a Git revert of the release PR that bumped the image tags.
-
-## Deploying a Version
-
-To deploy a specific release, reconcile the commit that pins the desired
-`vX.Y.Z` image tags in `platform/cluster/flux/**`. The deployed state is the
-Flux-applied Git state, so the image tags in the cluster manifests are the
-source of truth.
-
-## Rollback
-
-Rollback is performed by reverting the tag-bump commit or PR. Flux reconciles
-the reverted manifests and returns the affected workloads to the previously
-pinned image versions.
-
-## Keel Removal Sequencing
-
-Keel-based `:latest` auto-rolls are removed from the in-house app deploy path in
-a separate, sequenced PR. That Flux/Keel change must land only after the first
-versioned in-house images have been published, so every workload can be pinned
-to an existing version tag before `:latest` automation is removed.
diff --git a/release-please-config.json b/release-please-config.json
deleted file mode 100644
index a422ca91..00000000
--- a/release-please-config.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-  "packages": {
-    ".": {
-      "release-type": "simple",
-      "bump-minor-pre-major": true,
-      "changelog-path": "CHANGELOG.md",
-      "include-component-in-tag": false
-    }
-  }
-}