diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 88d824b2..8a993b11 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -37,6 +37,7 @@ jobs:
           images: ghcr.io/${{ github.repository }}
           tags: |
             type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
           flavor: |
             latest=auto
             suffix=${{ matrix.tag_suffix }},onlatest=true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index caba6c77..934cabf0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ Building Headplane from source now requires Go 1.27.1 or newer.
 ## Changes
 
 - Added `config.oidc.jwks_endpoint` to allow manually setting the JWKs keyset for OIDC (via [#620](https://github.com/tale/headplane/pull/620)).
+- Docker images now publish floating minor version tags (e.g., `0.7`) that always point to the latest patch release, so you can pin to a minor version in your `docker-compose.yml`.
 
 ## Fixes