diff --git a/docs/build-status.md b/docs/build-status.md
index da3bd57..896de1a 100644
--- a/docs/build-status.md
+++ b/docs/build-status.md
@@ -159,9 +159,13 @@ Repo pushed to git.rambossek.at/EchoLot/echolot (ssh :2222). Actions runner work
 paths+tags triggers never fire (split into test-server.yml / build-server.yml), and a greedy
 `sed` grabbed a nested user id instead of the release id → uploads 404ed (first-match grep now;
 release creation also falls back to GET-by-tag on re-runs). Binaries verified downloadable →
-`--self-update` has its artifact source. **Still open: the `image` job** — needs a
-docker-capable runner (GITHUB_SERVER_URL inside the runner is the internal `http://app:3000`;
-set `ECHOLOT_REGISTRY_HOST=git.rambossek.at` as a repo variable/env when enabling it).
+`--self-update` has its artifact source. **Image job green too** on the dedicated
+`compilesau-echolot` runner (label `echolot`): needed a PAT with package read/write as the
+`REGISTRY_TOKEN` repo secret — the built-in Actions token is rejected by the container
+registry. `git.rambossek.at/echolot/echolot-server:{v0.1.0,latest}` pulls anonymously
+(3.9 MB distroless, verified). Full chain proven: tag → tests → binaries → release assets →
+registry image → anonymous pull. Note the tag convention: image tags carry the bare version
+(`v0.1.0`), release tags the namespaced one (`server-v0.1.0`); selfupdate normalizes.
 
 ## Next steps
 1. Build locally, run on several physical devices (varied Android versions/vendors), collect the
diff --git a/server/internal/selfupdate/selfupdate.go b/server/internal/selfupdate/selfupdate.go
index 2896744..abf4ca6 100644
--- a/server/internal/selfupdate/selfupdate.go
+++ b/server/internal/selfupdate/selfupdate.go
@@ -49,7 +49,11 @@ func Run(api, currentVersion string) error {
 	if err := json.NewDecoder(resp.Body).Decode(&rel); err != nil {
 		return err
 	}
-	if rel.TagName == "" || rel.TagName == currentVersion {
+	// Tags are namespaced (server-v1.2.3) but binaries are stamped with the
+	// bare version (v1.2.3) — compare the normalized forms or the updater
+	// would re-download the same version forever.
+	latest := strings.TrimPrefix(rel.TagName, "server-")
+	if rel.TagName == "" || latest == currentVersion {
 		fmt.Printf("already current (%s)\n", currentVersion)
 		return nil
 	}