diff --git a/docs/deployment.md b/docs/deployment.md
index 6155178..cf071b5 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -163,5 +163,9 @@ Security rules of the pipeline:
   go in `security/trivyignore.txt` with a waiver row in [security.md](security.md).
 - `publish.yml` needs the `security` job (secret scan, security tests, dependency audit, bandit
   rules) as well as lint and tests.
-- The cleanup script removes containers only for per-run image names (`aegis-ci-<run id>-...`)
-  and immutable `:sha-` tags. Shared tags (`:latest`, `:main`, `:dev`) are only untagged.
+- The image is built under a per-run local tag (`aegis-ci-<run id>-build:<sha>`), scanned under
+  that tag, and the registry tags (`:sha-<12>`, `:dev`, `:latest`, `:main`) are applied only
+  immediately before the push. `build-and-push` needs `lint`, `test-unit`, `test-integration`,
+  `test-mcp` and `security`, so `:dev` and `:latest` are never pushed while one is red.
+- The cleanup script removes containers only for per-run image names (`aegis-ci-<run id>-...`).
+  Registry tags, the `:sha-` tag included, are only untagged.