diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 22446c1..1ee448d 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -33,6 +33,10 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+          labels: |
+            org.opencontainers.image.title=beacon-web
+            org.opencontainers.image.description=Beacon Web — real-time LoRa mesh packet analyzer
+            org.opencontainers.image.licenses=AGPL-3.0-or-later
           tags: |
             type=raw,value=latest,enable={{is_default_branch}}
             type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
diff --git a/README.md b/README.md
index 2c3718f..64e3957 100644
--- a/README.md
+++ b/README.md
@@ -33,20 +33,17 @@ EOF
 | `VITE_API_BASE` | Backend REST API base URL |
 | `VITE_WS_URL` | Backend WebSocket URL |
 
-### 3. Authenticate with GitHub Container Registry
-
-```bash
-docker login ghcr.io -u YOUR_GITHUB_USERNAME
-```
-
-Use a Personal Access Token (classic) with `read:packages` scope as the password. You only need to do this once.
-
-### 4. Start the services
+### 3. Start the services
 
 ```bash
 docker compose up -d
 ```
 
+The images are public on GitHub Container Registry — no `docker login` required.
+If a pull fails with `403 Forbidden`, the package visibility has regressed to
+Private; a maintainer needs to set it back to Public (see the troubleshooting note
+in [beacon-docs](https://github.com/MeshCore-Beacon/beacon-docs)).
+
 Caddy will automatically obtain a TLS certificate for your domain. Ensure DNS is pointed at your server before starting.
 
 ## Local Development