diff --git a/.gitea/workflows/build-prod.yaml b/.gitea/workflows/build-prod.yaml
index ba1aef2..0357908 100644
--- a/.gitea/workflows/build-prod.yaml
+++ b/.gitea/workflows/build-prod.yaml
@@ -52,7 +52,10 @@ jobs:
             .
 
       - name: Push
-        run: docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+        run: |
+          docker push "${IMAGE}:${{ steps.sha.outputs.short_sha }}"
+          docker tag "${IMAGE}:${{ steps.sha.outputs.short_sha }}" "${IMAGE}:latest"
+          docker push "${IMAGE}:latest"
 
       - name: Report digest
         run: |
diff --git a/k8s/kustomization.yaml b/k8s/kustomization.yaml
index 6bea1d2..0d9395f 100644
--- a/k8s/kustomization.yaml
+++ b/k8s/kustomization.yaml
@@ -11,13 +11,11 @@ resources:
 - configmap.yaml
 
 # The deployed image tag lives here and nowhere else. CI publishes
-# forgejo.riotpiao.com/rock/api-gateway:<commit-sha>; promoting a build is a
-# one-line commit bumping newTag, which Argo then syncs (G7).
-#
-#   kustomize edit set image forgejo.riotpiao.com/rock/api-gateway=:<sha>
+# forgejo.riotpiao.com/rock/api-gateway:<commit-sha> and tags it as :latest on main.
+# ArgoCD auto-syncs when the latest image is available.
 images:
 - name: forgejo.riotpiao.com/rock/api-gateway
-  newTag: v0.1.1
+  newTag: latest
 
 commonLabels:
   app: api-gateway