diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
new file mode 100644
index 0000000000..7baf0e0fc9
--- /dev/null
+++ b/.github/workflows/main.yaml
@@ -0,0 +1,84 @@
+name: Main
+
+on:
+  schedule:
+    - cron: "50 9,21 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+cache-mode: none
+
+concurrency:
+  group: main
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  version:
+    name: Select the main build
+    if: ${{ github.repository == 'coollabsio/coolify' }}
+    permissions:
+      contents: read
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 10
+    outputs:
+      build: ${{ steps.version.outputs.build }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # https://github.com/actions/checkout/releases/tag/v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+          persist-credentials: false
+
+      - id: version
+        env:
+          BRANCH: main
+        run: |
+          labels="$(docker buildx imagetools inspect ghcr.io/coollabsio/coolify:main --format '{{ json (index .Image "linux/amd64").Config.Labels }}')" || labels='{}'
+          MAIN_VERSION="$(jq -r '.["org.opencontainers.image.version"] // empty' <<< "$labels")"
+          MAIN_REVISION="$(jq -r '.["org.opencontainers.image.revision"] // empty' <<< "$labels")"
+          export MAIN_VERSION MAIN_REVISION
+          build="$(scripts/version.sh --main)"
+          echo "build=$build" | tee -a "$GITHUB_OUTPUT"
+
+  build:
+    name: Build
+    needs: version
+    if: ${{ needs.version.outputs.build != '' }}
+    permissions:
+      contents: read
+    uses: $/.github/workflows/build.yaml
+    with:
+      ref: ${{ fromJSON(needs.version.outputs.build).revision }}
+      coolify: ${{ fromJSON(needs.version.outputs.build).image }}
+
+  publish:
+    name: Move the main tag
+    needs: build
+    permissions:
+      packages: write # push the built main to ghcr.io and move the main tag
+    runs-on: ubuntu-26.04 # https://github.com/actions/runner-images
+    timeout-minutes: 30
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # https://github.com/actions/download-artifact/releases/tag/v8.0.2
+        with:
+          pattern: image-*
+          path: ${{ runner.temp }}/images
+
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # https://github.com/docker/login-action/releases/tag/v4.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Push the built main
+        run: |
+          sources=()
+          for index in "$RUNNER_TEMP"/images/*/index.json; do
+            sources+=("oci-layout://${index%/index.json}@$(jq -r '.manifests[0].digest' "$index")")
+          done
+          docker buildx imagetools create --tag ghcr.io/coollabsio/coolify:main "${sources[@]}"
diff --git a/RELEASE.md b/RELEASE.md
index 5aeef84b6b..5c341b893e 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -138,6 +138,14 @@ The nightly workflow publishes a nightly twice a day when its branch has a new c
 
 Print what the next run publishes with `scripts/version.sh --nightly`.
 
+## Main builds
+
+The main workflow builds `main` twice a day when it changed since the last build and moves `ghcr.io/coollabsio/coolify:main` to it, to test fixes before their patch release. A main build is versioned `<stable version>.<YYYYMMDD>.<N>`, `4.5.0.20261028.1`, which sorts after `4.5.0` and before `4.5.1`.
+
+- ghcr.io only, no version tag, no git tag, no GitHub release and no channel of the CDN
+
+Print what the next run builds with `scripts/version.sh --main`.
+
 ## Pull requests
 
 Every push to a pull request from a branch of this repository publishes `ghcr.io/coollabsio/coolify:pr-<number>`, versioned `<version of the base branch>-pr.<number>`. Pull request 1234 into `next` is `pr-1234` with the version `4.6.0-beta.1-pr.1234`, which sorts after `4.6.0-beta.1` and its nightlies and before `4.6.0-beta.2`.
diff --git a/scripts/version.sh b/scripts/version.sh
index 309117da11..bea72c1ff5 100755
--- a/scripts/version.sh
+++ b/scripts/version.sh
@@ -6,6 +6,8 @@ BRANCH="${BRANCH:-}"
 PULL_REQUEST="${PULL_REQUEST:-}"
 NIGHTLY_VERSION="${NIGHTLY_VERSION:-}"
 NIGHTLY_REVISION="${NIGHTLY_REVISION:-}"
+MAIN_VERSION="${MAIN_VERSION:-}"
+MAIN_REVISION="${MAIN_REVISION:-}"
 VERSION_FILE=release.json
 ARTIFACT=coolify
 UPSTREAM_FILE=upstream.json
@@ -24,11 +26,11 @@ die() {
 cd "$(dirname "$0")/.."
 
 main() {
-	[[ "$OPTION" =~ ^(--build|--release|--tags|--nightly)?$ ]] || die "'$OPTION' is not an option, expected --build, --release, --tags, --nightly or none"
+	[[ "$OPTION" =~ ^(--build|--release|--tags|--nightly|--main)?$ ]] || die "'$OPTION' is not an option, expected --build, --release, --tags, --nightly, --main or none"
 	read_version
 	fetch_origin
 	print_tags
-	print_next_nightly
+	print_next_build
 	check_branch
 	check_version
 	select_releases
@@ -69,14 +71,33 @@ print_tags() {
 	exit 0
 }
 
-print_next_nightly() {
-	[ "$OPTION" = --nightly ] || return 0
-	select_nightly_branch
-	[ "$revision" != "$NIGHTLY_REVISION" ] || exit 0
-	select_nightly_version
+print_next_build() {
+	local build current_version current_revision
+	[[ "$OPTION" =~ ^--(nightly|main)$ ]] || return 0
+	if [ "$OPTION" = --main ]; then
+		branch=main
+		revision="$(git rev-parse origin/main)"
+		current_version="$MAIN_VERSION" current_revision="$MAIN_REVISION"
+	else
+		select_nightly_branch
+		current_version="$NIGHTLY_VERSION" current_revision="$NIGHTLY_REVISION"
+	fi
+	[ "$revision" != "$current_revision" ] || exit 0
+	if [ "$OPTION" = --main ]; then
+		base="$(artifact_version stable <(git show "$revision:$VERSION_FILE" 2> /dev/null))"
+		[ -n "$base" ] || die "main has no stable version of $ARTIFACT in $VERSION_FILE, expected the release process there"
+	else
+		select_nightly_base
+	fi
+	build="$base.$(date -u +%Y%m%d)"
+	if [[ "$current_version" == "$build".* ]]; then
+		build+=".$((${current_version##*.} + 1))"
+	else
+		build+=".1"
+	fi
 	upstream_lines <(git show "$revision:$UPSTREAM_FILE") | while read -r name upstream; do
-		jq -nc --arg name "$name" --arg version "$upstream" --arg tag "${upstream:+$upstream-}v$nightly" '{$name, $version, $tag}'
-	done | jq -sc --arg branch "$branch" --arg revision "$revision" --arg image "$nightly" '{$branch, $revision, $image, lines: .}'
+		jq -nc --arg name "$name" --arg version "$upstream" --arg tag "${upstream:+$upstream-}v$build" '{$name, $version, $tag}'
+	done | jq -sc --arg branch "$branch" --arg revision "$revision" --arg image "$build" '{$branch, $revision, $image, lines: .}'
 	exit 0
 }
 
@@ -90,8 +111,7 @@ select_nightly_branch() {
 	revision="$(git rev-parse "origin/$branch")"
 }
 
-select_nightly_version() {
-	local base number=1
+select_nightly_base() {
 	version="$(artifact_version preview <(git show "$revision:$VERSION_FILE"))"
 	if [ -n "$line" ]; then
 		base="$line.0-alpha.0"
@@ -101,9 +121,6 @@ select_nightly_version() {
 	else
 		base="$(next_version "$stable" minor)-alpha.0"
 	fi
-	nightly="$base.$(date -u +%Y%m%d)"
-	[[ "$NIGHTLY_VERSION" != "$nightly".* ]] || number=$((${NIGHTLY_VERSION##*.} + 1))
-	nightly+=".$number"
 }
 
 check_branch() {