diff --git a/.github/actions/check-prerelease/action.yml b/.github/actions/check-prerelease/action.yml
new file mode 100644
index 0000000..28beb1b
--- /dev/null
+++ b/.github/actions/check-prerelease/action.yml
@@ -0,0 +1,21 @@
+name: Checks whether a version is a prerelease
+description: Checks whether a version is prerelease according to PEP440.
+inputs:
+  version:
+    description: Version number to check.
+    required: true
+outputs:
+  prerelease:
+    description: Whether the version number is a prerelease.
+    value: ${{ steps.check-prerelease.outputs.PRERELEASE }}
+runs:
+  using: composite
+  steps:
+    - name: Install packaging
+      run: pip install packaging
+      shell: bash
+
+    - name: Check if prerelease
+      id: check-prerelease
+      run: ./.github/actions/check-prerelease/check_prerelease.py ${{ inputs.version }} >> "$GITHUB_OUTPUT"
+      shell: bash
diff --git a/.github/actions/check-prerelease/check_prerelease.py b/.github/actions/check-prerelease/check_prerelease.py
new file mode 100755
index 0000000..6ead58e
--- /dev/null
+++ b/.github/actions/check-prerelease/check_prerelease.py
@@ -0,0 +1,17 @@
+#!/usr/bin/env python3
+
+import argparse
+
+from packaging.version import parse as parse_version
+
+if __name__ == "__main__":
+    arg_parser = argparse.ArgumentParser(
+        description="Check whether a version is a prerelease according to PEP440."
+    )
+    arg_parser.add_argument("version")
+    args = arg_parser.parse_args()
+
+    if parse_version(args.version).is_prerelease:
+        print("PRERELEASE=true")
+    else:
+        print("PRERELEASE=false")
diff --git a/.github/actions/get-latest-release/action.yml b/.github/actions/get-latest-release/action.yml
new file mode 100644
index 0000000..b920c7c
--- /dev/null
+++ b/.github/actions/get-latest-release/action.yml
@@ -0,0 +1,21 @@
+name: Get latest release
+description: Gets the latest (non-prerelease) version of a PyPI package.
+inputs:
+  package:
+    description: Name of the the package.
+    required: true
+outputs:
+  latest_version:
+    description: Latest version of the package.
+    value: ${{ steps.get-latest.outputs.VERSION }}
+runs:
+  using: composite
+  steps:
+    - name: Install packaging
+      run: pip install packaging requests
+      shell: bash
+
+    - name: Get latest version
+      id: get-latest
+      run: ./.github/actions/get-latest-release/get_latest_release.py ${{ inputs.package }} >> "$GITHUB_OUTPUT"
+      shell: bash
diff --git a/.github/actions/get-latest-release/get_latest_release.py b/.github/actions/get-latest-release/get_latest_release.py
new file mode 100755
index 0000000..66f777e
--- /dev/null
+++ b/.github/actions/get-latest-release/get_latest_release.py
@@ -0,0 +1,24 @@
+#!/usr/bin/env python3
+
+import argparse
+
+import requests
+from packaging.version import parse as parse_version
+
+if __name__ == "__main__":
+    arg_parser = argparse.ArgumentParser(
+        description="Get the latest non-prerelease version of a package according to PEP440."
+    )
+    arg_parser.add_argument("package")
+    args = arg_parser.parse_args()
+
+    r = requests.get(
+        f"https://pypi.org/simple/{args.package}",
+        headers={"Accept": "application/vnd.pypi.simple.v1+json"},
+        timeout=30,
+    )
+    r.raise_for_status()
+    versions = [parse_version(v) for v in r.json().get("versions", [])]
+    latest = max(v for v in versions if not v.is_prerelease)
+    if latest:
+        print(f"VERSION={latest}")
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2fd16e4..f9185f7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -121,11 +121,18 @@ jobs:
         with:
           args: --standalone --wrap none -f rst -t gfm --output=release-body.md release-body.rst
 
+      - name: Check if prerelease
+        id: check-prerelease
+        uses: ./.github/actions/check-prerelease
+        with:
+          version: ${{ steps.version.outputs.version }}
+
       - name: Create GitHub release
         uses: softprops/action-gh-release@v1
         with:
           body_path: release-body.md
           tag_name: v${{ steps.version.outputs.version }}
+          prerelease: ${{ steps.check-prerelease.outputs.prerelease }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index beadb8b..d48e483 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -65,6 +65,32 @@ jobs:
         with:
           images: ${{ env.IMAGE_NAME }}
 
+      - name: Check if prerelease
+        id: check-prerelease
+        uses: ./.github/actions/check-prerelease
+        with:
+          version: ${{ steps.version.outputs.version }}
+
+      - name: Get latest release
+        id: latest-version
+        uses: ./.github/actions/get-latest-release
+        with:
+          package: dmarc-metrics-exporter
+
+      - name: Set tags
+        id: set-tags
+        shell: bash
+        run: |
+          {
+            echo 'TAGS<<EOF'
+            echo ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
+            [ ${{ steps.version.outputs.version }} = ${{ steps.latest-version.outputs.latest_version }} ] \
+              && [ ${{ steps.check-prerelease }} != true ] \
+              && echo ${{ env.IMAGE_NAME }}:latest
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+
+
       # Build and push Docker image with Buildx (don't push on PR)
       # https://github.com/docker/build-push-action
       - name: Build and push Docker image
@@ -72,7 +98,7 @@ jobs:
         with:
           context: .
           push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ env.IMAGE_NAME }}:${{ steps.version.outputs.version }}
+          tags: ${{ steps.set-tags.outputs.TAGS }}
           platforms: linux/amd64,linux/arm64
           labels: ${{ steps.meta.outputs.labels }}
           build-args: "version=${{ steps.version.outputs.version }}"