diff --git a/docker-compose.yml b/docker-compose.yml
index 2cf09af..9eeadd4 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -9,11 +9,7 @@
 
 services:
   dockmv:
-    build:
-      context: .
-      args:
-        VERSION: ${VERSION:-dev}
-    image: dockmv:latest
+    image: git.azuze.fr/kawa/dockmv:${VERSION:-latest}
     container_name: dockmv
     restart: unless-stopped
     ports:
diff --git a/scripts/publish.ps1 b/scripts/publish.ps1
index 69edf02..eabf66f 100644
--- a/scripts/publish.ps1
+++ b/scripts/publish.ps1
@@ -10,11 +10,13 @@
 
     It also cross-compiles the release binaries (scripts/build-release.ps1) from
     the same commit, so both artifacts carry the same -Tag. Archives cannot live
-    in a container registry, so -PublishRelease attaches them to the Gitea
-    release for that tag instead (creating the release if it does not exist).
+    in a container registry, so they're attached to the Gitea release for that
+    tag instead (creating the release if it does not exist) — on by default,
+    since a run that builds binaries and doesn't publish them is the unusual
+    case. Pass -NoPublishRelease to build locally without uploading.
 
     -BinariesOnly ships just the binaries: no docker build, no docker login, no
-    image push, and the release upload is implied.
+    image push.
 
     Credentials are read, in order of precedence:
       1. -Username / -Password parameters
@@ -27,11 +29,12 @@
 
 .EXAMPLE
     ./scripts/publish.ps1
-    Build and push :latest plus the git-describe tag; build dist/ binaries locally.
+    Full release: push the image (:latest plus the git-describe tag) and attach
+    every dist/ archive to the matching Gitea release.
 
 .EXAMPLE
-    ./scripts/publish.ps1 -Tag v1.2.0 -PublishRelease
-    Full release: push the image and attach every dist/ archive to release v1.2.0.
+    ./scripts/publish.ps1 -Tag v1.2.0 -NoPublishRelease
+    Push the image and build dist/ binaries locally, but don't upload them.
 
 .EXAMPLE
     ./scripts/publish.ps1 -BinariesOnly -Tag v1.2.0
@@ -44,7 +47,7 @@
 
 .EXAMPLE
     ./scripts/publish.ps1 -NoBinaries
-    Container only — no cross-compile.
+    Container only — no cross-compile, nothing to publish as a release.
 
 .EXAMPLE
     $env:GITEA_USER = "kawa"; $env:GITEA_TOKEN = "xxxx"; ./scripts/publish.ps1 -SkipLogin:$false
@@ -96,13 +99,12 @@ param(
     # retrying a failed upload without paying for the build again.
     [switch]$NoBinaryBuild,
 
-    # Ship only the binaries: no docker build, login or push. Implies
-    # -PublishRelease, since building alone is what build-release.ps1 already does.
+    # Ship only the binaries: no docker build, login or push.
     [switch]$BinariesOnly,
 
-    # Attach the release archives to the Gitea release for $Tag, creating the
-    # release if it is missing.
-    [switch]$PublishRelease,
+    # Skip attaching the release archives to the Gitea release for $Tag. The
+    # upload happens by default whenever binaries are built.
+    [switch]$NoPublishRelease,
 
     # owner/repo holding the release. Defaults to $Owner/$Repo.
     [string]$ReleaseRepo,
@@ -282,15 +284,21 @@ try {
     if ($NoBinaryBuild -and $NoBinaries) {
         throw "-NoBinaryBuild reuses the build that -NoBinaries skips entirely — pick one."
     }
+    if ($BinariesOnly -and $NoPublishRelease) {
+        throw "-BinariesOnly with -NoPublishRelease leaves nothing to do — pick one."
+    }
     if ($BinariesOnly) {
         # Nothing to build, log into or push on the container side, and uploading
         # is the whole point (build-release.ps1 alone covers "just build them").
-        $NoBuild        = $true
-        $SkipLogin      = $true
-        $PublishRelease = $true
+        $NoBuild   = $true
+        $SkipLogin = $true
     }
     $pushImage = -not $BinariesOnly
 
+    # On by default: a run that builds binaries and doesn't publish them is the
+    # unusual case. -NoBinaries means there is nothing to publish either way.
+    $PublishRelease = (-not $NoPublishRelease) -and (-not $NoBinaries)
+
     if (-not $ReleaseRepo) { $ReleaseRepo = "$Owner/$Repo" }
     if (-not $ApiBase)     { $ApiBase = "https://$Registry" }
     $apiRoot = "$($ApiBase.TrimEnd('/'))/api/v1"
@@ -415,7 +423,7 @@ try {
     $releaseUrl = $null
     if ($PublishRelease) {
         if (-not $artifacts.Count) {
-            throw "-PublishRelease has nothing to upload (was -NoBinaries set?)."
+            throw "nothing to upload — no release archives were built (was -NoBinaries set?)."
         }
         Write-Host "Uploading binaries to release $Tag..." -ForegroundColor Cyan
         $Password   = Resolve-Token -Provided $Password -Purpose "release upload to $ReleaseRepo"