diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e9c444610..8d410f66e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,9 +11,50 @@ env:
   PYTHON_VERSION: "3.12"
 
 jobs:
+  # GA images build for release tags (vX.Y.Z), never for RC tags (build_rc.yml
+  # owns those). This job also enforces "the tag is on main": we can't use
+  # github.event.base_ref for that — it is empty for a tag pushed to a
+  # branch-protected main (which only receives PR-merge commits, not client
+  # pushes), so the old base_ref guard silently skipped every release build.
+  # Instead we verify reachability from origin/main explicitly and fail loud.
+  verify-tag:
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-rc.')
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      # Tag name and SHA are passed as env data, never interpolated into the
+      # script body: ${{ }} expands before the shell runs, and git permits
+      # ; $ ` " | & in ref names — so a crafted tag could otherwise execute
+      # arbitrary code in this privileged publishing workflow.
+      - name: Verify this is an exact GA release tag on main
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+          TAG_SHA: ${{ github.sha }}
+        run: |
+          # The job-level `if` only filters well-formed `-rc.` tags (owned by
+          # build_rc.yml). Anything else reaching here must be an exact GA tag:
+          # a near-miss like `v1.2.3-rc1` matches neither workflow's intent and
+          # would otherwise publish a prerelease as GA and move `latest`.
+          if ! printf '%s' "$TAG_NAME" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "::error::$TAG_NAME is not an exact GA release tag (vMAJOR.MINOR.PATCH) — refusing to publish GA images."
+            exit 1
+          fi
+          git fetch --no-tags origin main
+          if git merge-base --is-ancestor "$TAG_SHA" FETCH_HEAD; then
+            echo "OK: $TAG_NAME ($TAG_SHA) is an exact GA tag on main"
+          else
+            echo "::error::$TAG_NAME is not on main — refusing to publish GA images."
+            exit 1
+          fi
+
   build-and-push-image:
+    needs: verify-tag
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/') && github.event.base_ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -68,8 +109,8 @@ jobs:
           cache-to: type=gha,mode=max
 
   build-and-push-image-ray:
+    needs: verify-tag
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/') && github.event.base_ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
@@ -116,8 +157,8 @@ jobs:
           cache-to: type=gha,mode=max
 
   build-and-push-image-admin-ui:
+    needs: verify-tag
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/') && github.event.base_ref == 'refs/heads/main'
     permissions:
       contents: read
       packages: write
diff --git a/infra/charts/openrag-stack/Chart.yaml b/infra/charts/openrag-stack/Chart.yaml
index 73e5da635..e96691aa7 100644
--- a/infra/charts/openrag-stack/Chart.yaml
+++ b/infra/charts/openrag-stack/Chart.yaml
@@ -15,13 +15,13 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.5.1
+version: 0.5.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "2.0.0"
+appVersion: "2.0.1"
 
 dependencies:
   - name: kuberay-operator
diff --git a/infra/charts/openrag-stack/values.yaml b/infra/charts/openrag-stack/values.yaml
index 38b55ab03..6e36a781d 100644
--- a/infra/charts/openrag-stack/values.yaml
+++ b/infra/charts/openrag-stack/values.yaml
@@ -33,7 +33,7 @@ ray:
   image:
     repository: ghcr.io/linagora/openrag-ray
     # Pin to a release tag (ideally a digest) for reproducible deploys.
-    tag: "1.1.13"
+    tag: "v2.0.1"
 
 # === PostgreSQL (bitnami) ===
 postgresql:
@@ -262,7 +262,7 @@ adminUi:
     repository: linagoraai/openrag-admin-ui
     # Pin to a release tag (ideally a digest) for reproducible deploys. Must be a
     # build from infra/docker/ui.Dockerfile (nginx-unprivileged, listens :8080).
-    tag: "v2.0.0"
+    tag: "v2.0.1"
   imagePullPolicy: IfNotPresent
   replicaCount: 1
   service:
@@ -276,7 +276,7 @@ openrag:
   image:
     repository: linagoraai/openrag
     # Pin to a release tag (ideally a digest) for reproducible deploys.
-    tag: "1.1.13"
+    tag: "v2.0.1"
   service:
     type: ClusterIP
     port: 8080
diff --git a/infra/compose/docker-compose.yaml b/infra/compose/docker-compose.yaml
index 9e46a9e76..5ca821fb5 100644
--- a/infra/compose/docker-compose.yaml
+++ b/infra/compose/docker-compose.yaml
@@ -18,7 +18,7 @@ x-openrag-env: &openrag_env
   FONT_PATH: ${FONT_PATH:-/app/data/fonts/GoNotoCurrent-Regular.ttf}
 
 x-openrag: &openrag_template
-  image: linagoraai/openrag:v2.0.0
+  image: linagoraai/openrag:v2.0.1
   # Start as root so entrypoint.sh can grant GID-0 write on the bind-mounted
   # writable dirs (data/, logs/, the HF cache) — which a non-root container
   # can't write when Docker auto-creates them root-owned — then it immediately
@@ -113,7 +113,7 @@ x-vllm: &vllm_template
 services:
   # ── Admin UI (React SPA + nginx, same-origin reverse proxy to the API) ──
   admin-ui:
-    image: linagoraai/openrag-admin-ui:v2.0.0
+    image: linagoraai/openrag-admin-ui:v2.0.1
     build:
       context: ../..
       dockerfile: infra/docker/ui.Dockerfile
diff --git a/pyproject.toml b/pyproject.toml
index 0fbc63848..21e5f5b89 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "openrag"
-version = "2.0.0"
+version = "2.0.1"
 description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/uv.lock b/uv.lock
index bab457661..06d2a8b73 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2713,7 +2713,7 @@ wheels = [
 
 [[package]]
 name = "openrag"
-version = "2.0.0"
+version = "2.0.1"
 source = { editable = "." }
 dependencies = [
     { name = "aiobreaker" },