diff --git a/.github/workflows/codeql-lint.yml b/.github/workflows/codeql-lint.yml
index 01e3a165..9bdf5ec4 100644
--- a/.github/workflows/codeql-lint.yml
+++ b/.github/workflows/codeql-lint.yml
@@ -350,8 +350,9 @@ jobs:
             type=sha,prefix=sha-,format=short
             type=raw,value=latest,enable={{is_default_branch}}
 
-      # :full metadata mirrors the lean tags with a -full suffix; :develop is a
-      # deprecated alias of :full for existing pulls, dropped after a transition.
+      # Full tags are release-shaped only: semver with a -full suffix, plus the
+      # default branch's rolling :full and sha-*-full. No branch tags — branch
+      # pushes build lean only (the empty tag list skips the build below).
       - name: Extract Docker metadata (full)
         id: meta_full
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
@@ -363,7 +364,6 @@ jobs:
             type=semver,pattern={{major}},suffix=-full
             type=sha,prefix=sha-,suffix=-full,format=short,enable={{is_default_branch}}
             type=raw,value=full,enable={{is_default_branch}}
-            type=raw,value=develop,enable={{is_default_branch}}
 
       - name: Build and push lean image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
diff --git a/.github/workflows/on-branch-delete.yml b/.github/workflows/on-branch-delete.yml
index c3c6bd23..2b0ebf8d 100755
--- a/.github/workflows/on-branch-delete.yml
+++ b/.github/workflows/on-branch-delete.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Skip protected branches
         id: guard
         run: |
-          if [[ "$REF" == "main" || "$REF" == "master" || "$REF" == "experimental" || "$REF" == "develop" ]]; then
+          if [[ "$REF" == "main" || "$REF" == "master" || "$REF" == "experimental" ]]; then
             echo "Skipping deletion for protected branch: $REF"
             echo "protected=true" >> "$GITHUB_OUTPUT"
           fi
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 5a58fe49..eb6e611e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -49,11 +49,14 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push
+      - name: Build and push (lean)
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           file: ./deploy/docker/Dockerfile
+          # Explicit: the bare default is only lean while `runtime` stays the
+          # final stage in the Dockerfile.
+          target: runtime
           platforms: linux/amd64,linux/arm64
           build-args: |
             BRANCH=main
@@ -62,3 +65,18 @@ jobs:
             ghcr.io/${{ github.repository_owner }}/chub:${{ needs.release.outputs.tag_name }}
             ghcr.io/${{ github.repository_owner }}/chub:${{ needs.release.outputs.version }}
             ghcr.io/${{ github.repository_owner }}/chub:latest
+
+      - name: Build and push (full)
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
+        with:
+          context: .
+          file: ./deploy/docker/Dockerfile
+          target: full
+          platforms: linux/amd64,linux/arm64
+          build-args: |
+            BRANCH=main
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/chub:${{ needs.release.outputs.tag_name }}-full
+            ghcr.io/${{ github.repository_owner }}/chub:${{ needs.release.outputs.version }}-full
+            ghcr.io/${{ github.repository_owner }}/chub:full
diff --git a/README.md b/README.md
index 9f21e045..ec08d4a8 100755
--- a/README.md
+++ b/README.md
@@ -84,7 +84,6 @@ Full walk-through: **[Wiki → Installation](https://github.com/chodeus/chub/wik
 | `latest` | Core CHUB, kept deliberately minimal (~210 MB compressed). |
 | `full` | Everything in `latest` plus the extension toolchain: the **CL2K poster maker** (ImageMagick + librsvg rendering, real Arial, layered PSD export) and the **poster self-heal** module (~345 MB). |
 | `vX.Y.Z` / `vX.Y.Z-full` | The same two images pinned to a release. |
-| `develop` | Deprecated alias of `full` — switch to `full`; this alias will stop updating. |
 
 Switching between tags is safe in both directions: the tools live in the image, not your volume. A config written under `full` keeps its extension sections on `latest` (typed, preserved across saves), database tables and generated posters are never touched, and moving back to `full` finds everything as you left it. Leaving `full` for good and want a spotless config? Delete the `cl2k_maker:` and `poster_self_heal:` blocks from `config.yml` — that's all there is.