diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b237d28665..87563f8da2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -470,6 +470,17 @@ jobs:
           # shellcheck disable=SC2086  # PRERELEASE_FLAG is '--prerelease' or empty
           gh release create "$RELEASE_TAG" --target "$RELEASE_COMMIT" $PRERELEASE_FLAG --title "$ANNOUNCEMENT_TITLE" --notes-file "$RUNNER_TEMP/notes.txt" artifacts/*
 
+  # Build and push Docker Hub images (:version, :latest, :sha-*) after the GitHub Release exists.
+  docker-image:
+    needs: host
+    if: ${{ always() && needs.host.result == 'success' }}
+    permissions:
+      contents: read
+      packages: read
+      actions: write
+    uses: ./.github/workflows/docker.yml
+    secrets: inherit
+
   # Commit patched manifest SHA256 checksums back to main so the repo
   # stays in sync with the released artifacts.
   update-registry-checksums: