diff --git a/README.md b/README.md
index cf6010e..2f6662b 100644
--- a/README.md
+++ b/README.md
@@ -20,8 +20,9 @@
 ![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6?logo=typescript&logoColor=white)
 ![PostgreSQL](https://img.shields.io/badge/PostgreSQL-Prisma%207-4169e1?logo=postgresql&logoColor=white)
 ![Self-hosted](https://img.shields.io/badge/deployment-self--hosted-2ea44f)
+[![Docker Hub](https://img.shields.io/docker/v/whitemuush/datashield?logo=docker&logoColor=white&label=Docker%20Hub&sort=semver)](https://hub.docker.com/r/whitemuush/datashield)
 
-[Live demo](https://datashield.melvinpetit.com) (read only, no signup)
+[Live demo](https://datashield.melvinpetit.com) (read only, no signup) - [Docker image](https://hub.docker.com/r/whitemuush/datashield)
 
 </div>
 
@@ -186,6 +187,16 @@ built by `compose.yml`: it bind-mounts the source and runs `next dev`.
 standalone server, runs as an unprivileged user and applies pending migrations
 on start.
 
+The published image lives on Docker Hub at
+[`whitemuush/datashield`](https://hub.docker.com/r/whitemuush/datashield), so a
+deployment can pull it directly instead of building.
+
+```bash
+docker pull whitemuush/datashield:latest
+```
+
+To build it yourself instead:
+
 ```bash
 docker build -t datashield:local .
 docker run --rm -p 3000:3000 --env-file .env.local datashield:local