diff --git a/deploy/Pulumi.gcpProd.yaml b/deploy/Pulumi.gcpProd.yaml
index f3a0c88..5283152 100644
--- a/deploy/Pulumi.gcpProd.yaml
+++ b/deploy/Pulumi.gcpProd.yaml
@@ -1,6 +1,7 @@
 config:
   mcp-registry:environment: prod
   mcp-registry:provider: gcp
+  mcp-registry:imageTag: latest  # Set specific image tag for production (change this to deploy different versions)
   gcp:project: mcp-registry-prod
   mcp-registry:githubClientId: Iv23liUydBbI7Z2Q9bOZ
   mcp-registry:githubClientSecret:
diff --git a/deploy/README.md b/deploy/README.md
index c2557e9..3e4142d 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -29,7 +29,15 @@ PULUMI_CONFIG_PASSPHRASE="" pulumi config set mcp-registry:githubClientSecret --
 
 ### Production Deployment (GCP)
 
-**Note:** The production deployment is automatically handled by GitHub Actions. All merges to the `main` branch trigger an automatic deployment to GCP via [the configured GitHub Actions workflow](../.github/workflows/deploy.yml). The steps below are preserved as a log of what we did, or if a manual override is needed.
+**Note:** The production deployment is automatically handled by GitHub Actions. All merges to the `main` branch trigger an automatic deployment the `staging` environment at GCP via [the configured GitHub Actions workflow](../.github/workflows/deploy.yml).
+
+**Important:** Deployment to `prod` require explicit configuration of the Docker image tag in `Pulumi.gcpProd.yaml`. This prevents automatic promotion of new releases and provides manual control over production versions. To deploy a specific version:
+
+1. Update `mcp-registry:imageTag` in `Pulumi.gcpProd.yaml` to the desired version (e.g., `v1.0.0`, `main-20250930-abc123d`)
+2. Commit the changes and open a PR to `main`
+3. Once merged, the GitHub Actions workflow will deploy the specified version
+
+The steps below are preserved as a log of what we did, or if a manual override is needed.
 
 Pre-requisites:
 - [Pulumi CLI installed](https://www.pulumi.com/docs/iac/download-install/)
@@ -113,6 +121,7 @@ Pre-requisites:
 | `provider` | Kubernetes provider (local/gcp) | No (default: local) |
 | `githubClientId` | GitHub OAuth Client ID | Yes |
 | `githubClientSecret` | GitHub OAuth Client Secret | Yes |
+| `imageTag` | Docker image tag for production environment | Yes (prod only) |
 | `gcpProjectId` | GCP Project ID (required when provider=gcp) | No |
 | `gcpRegion` | GCP Region (default: us-central1) | No |
 
diff --git a/deploy/pkg/k8s/registry.go b/deploy/pkg/k8s/registry.go
index 2e8df17..d4a3c13 100644
--- a/deploy/pkg/k8s/registry.go
+++ b/deploy/pkg/k8s/registry.go
@@ -35,7 +35,9 @@ func DeployMCPRegistry(ctx *pulumi.Context, cluster *providers.ProviderInfo, env
 	// Determine Docker image tag based on environment
 	imageTag := "main" // Default for staging
 	if environment == "prod" {
-		imageTag = "latest" // Use latest release for production
+		// Use explicitly configured image tag for production
+		// This prevents automatic promotion and requires manual control of production releases
+		imageTag = conf.Require("imageTag") // Explicit configuration required - no fallback
 	}
 
 	// Create Secret with sensitive configuration
diff --git a/docs/guides/contributing/releasing.md b/docs/guides/contributing/releasing.md
index cfb485c..9ce96f8 100644
--- a/docs/guides/contributing/releasing.md
+++ b/docs/guides/contributing/releasing.md
@@ -21,6 +21,8 @@ The release workflow will automatically:
   - `ghcr.io/modelcontextprotocol/registry:vX.Y.Z` - Specific release version
 - Binaries can be downloaded from the GitHub release page
 
+**Note:** Releases do not automatically deploy to production. See the [deployment documentation](../../deploy/README.md) for production deployment instructions.
+
 ## Docker Image Tags
 
 The registry publishes different Docker image tags for different use cases: