diff --git a/.github/workflows/release-server.yml b/.github/workflows/release-server.yml
index b9c1481..052960b 100644
--- a/.github/workflows/release-server.yml
+++ b/.github/workflows/release-server.yml
@@ -70,6 +70,24 @@ jobs:
           cache-from: type=gha,scope=rmm-server
           cache-to: type=gha,mode=max,scope=rmm-server
 
+      - name: Build and optionally publish tunnel image
+        uses: docker/build-push-action@v6
+        with:
+          context: deploy/tunnel
+          file: deploy/tunnel/Dockerfile
+          push: ${{ startsWith(github.ref, 'refs/tags/server-v') }}
+          tags: |
+            ghcr.io/benya9669/openwrt-rmm-tunnel:${{ steps.version.outputs.value }}
+            ghcr.io/benya9669/openwrt-rmm-tunnel:latest
+          labels: |
+            org.opencontainers.image.title=OpenWrt RMM Tunnel
+            org.opencontainers.image.source=https://github.com/Benya9669/openwrt-rmm
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.version=${{ steps.version.outputs.value }}
+            org.opencontainers.image.licenses=AGPL-3.0-only
+          cache-from: type=gha,scope=rmm-tunnel
+          cache-to: type=gha,mode=max,scope=rmm-tunnel
+
       - name: Create GitHub release
         if: startsWith(github.ref, 'refs/tags/server-v')
         env:
diff --git a/Dockerfile b/Dockerfile
index fda504e..da5bafe 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only
 FROM golang:1.26.5-alpine AS build
 
 WORKDIR /src
diff --git a/LICENSE.md b/LICENSE.md
index 395a6fc..1cbcdf4 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -5,12 +5,14 @@ Copyright (c) 2026 Benya.
 This repository uses separate licenses for the cloud application and the OpenWrt
 components:
 
-- `server/` and `web/` are licensed under the GNU Affero General Public License,
-  version 3 only (`AGPL-3.0-only`). The canonical license text is in
+- `server/`, `web/`, `deploy/tunnel/`, the root server `Dockerfile` and
+  `compose.yaml` are licensed under the GNU Affero General Public License, version 3
+  only (`AGPL-3.0-only`). The canonical license text is in
   `LICENSES/AGPL-3.0-only.txt`.
 - `agent/`, including the Go agent, shell compatibility agent, LuCI application,
-  OpenWrt package recipes and their configuration files, is licensed under the MIT
-  License. The license text is in `LICENSES/MIT.txt` and `agent/LICENSE`.
+  OpenWrt package recipes and their configuration files, and `deploy/luci-builder/`
+  are licensed under the MIT License. The license text is in `LICENSES/MIT.txt` and
+  `agent/LICENSE`.
 - Documentation outside those directories is licensed under `AGPL-3.0-only`, unless a
   file states otherwise.
 
diff --git a/RELEASES.md b/RELEASES.md
index fd867eb..4f12729 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -7,14 +7,22 @@ Versioning.
 
 Tags use `server-vMAJOR.MINOR.PATCH`, for example `server-v0.8.0`.
 
-A server release contains the Go API, web interface, database migrations and deployment
-files. The GitHub Actions server workflow tests the server and publishes:
+A server release contains the Go API, web interface, database migrations and the coupled
+SSH reverse-tunnel service. The GitHub Actions server workflow tests the server and
+publishes two images with the same version:
 
 ```text
 ghcr.io/benya9669/openwrt-rmm-server:0.8.0
 ghcr.io/benya9669/openwrt-rmm-server:latest
+ghcr.io/benya9669/openwrt-rmm-tunnel:0.8.0
+ghcr.io/benya9669/openwrt-rmm-tunnel:latest
 ```
 
+The tunnel remains a separate container for isolation, but shares the server release line
+because its SSH policy and port-forwarding behavior form part of the server-side protocol.
+Introduce independent `tunnel-v*` releases only if the tunnel later gains a separate API
+and lifecycle.
+
 Increment `MAJOR` for incompatible API or migration requirements, `MINOR` for compatible
 features, and `PATCH` for compatible fixes. Database backups remain mandatory before a
 production upgrade even when the release is marked compatible.
diff --git a/deploy/luci-builder/Dockerfile b/deploy/luci-builder/Dockerfile
index 1696b12..139a6e8 100644
--- a/deploy/luci-builder/Dockerfile
+++ b/deploy/luci-builder/Dockerfile
@@ -1,4 +1,5 @@
 # syntax=docker/dockerfile:1
+# SPDX-License-Identifier: MIT
 
 FROM golang:1.26.5-bookworm AS go-agent
 
diff --git a/deploy/tunnel/Dockerfile b/deploy/tunnel/Dockerfile
index ae9a729..6e665a0 100644
--- a/deploy/tunnel/Dockerfile
+++ b/deploy/tunnel/Dockerfile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: AGPL-3.0-only
 FROM alpine:3.21
 
 RUN apk add --no-cache openssh-server netcat-openbsd