diff --git a/AGENTS.md b/AGENTS.md
index 467a37aef1..af4efb79ab 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -286,9 +286,35 @@ The persistent-storage implementation is the reference pattern: `Project\Service
 
 ## Git Workflow
 
-- Production branch: `main`
-- Development branch: `next`. Do not create `release/v*` branches.
-- Fix PRs should target the current production branch; feature PRs should target `next`
+- Production branch: `main`. It takes fixes only. A new minor or major version gets to `main` as a merge of `next` or a release branch.
+- Development branch: `next`. It takes features and publishes prereleases only.
+- Fix PRs target `main`. Feature PRs target `next`.
+- Name a branch after its change: `fix/<topic>` or `feat/<topic>`. Name a backport branch after the version that releases it: `fix/<topic>-v4.4.8`.
+- Merge `next`, `release/v*` branches, and patch branches (`v4.x`, `v4.4.x`) with a merge commit. Never squash merge them, because their commits then come back as conflicts in each later merge.
+- Create `release/v*` and patch branches only when the user asks.
+
+## Releases
+
+[`RELEASE.md`](RELEASE.md) is the source of truth for releases. Read it before you do a release, a backport, or a major version, and before you change `upstream.json`, `scripts/release.sh`, `scripts/plan-version.sh`, `scripts/sync-cdn.sh`, or the release, nightly, pull request, or merge forward workflows.
+
+- Describe each change that users can see under `## [Unreleased]` in `CHANGELOG.md`. The release notes come from these entries.
+- A push that changes `release.json` publishes a release.
+- NEVER edit `release.json` by hand. `scripts/release.sh` changes it.
+- `scripts/plan-version.sh` shows what the current branch releases. `scripts/plan-version.sh --nightly` shows the next nightly.
+- `scripts/release.sh` is interactive and makes a signed commit. Do not run it, push a release commit, or start the release or nightly workflow yourself. Give the user the commands from `RELEASE.md` for the release type:
+
+| Release | Branch | Command |
+| --- | --- | --- |
+| Alpha, beta, or RC of the next minor or major | `next` | `scripts/release.sh`, then select the stage and the version |
+| Prerelease of one minor or major | `release/v4.6`, `release/v5.0` | `scripts/release.sh` |
+| Stable patch or minor | `main` | Merge `next` or the release branch with a merge commit when needed, then `scripts/release.sh` |
+| Stable major | `main` | Do the steps in "Release a major version" of `RELEASE.md`, then `scripts/release.sh` |
+| Backport or hotfix | `v4.4.x` | Merge `fix/<topic>-v4.4.8` with a merge commit, then `scripts/release.sh` |
+| Nightly | `next`, or the release branch in progress | Automatic, two times each day |
+| Pull request image `pr-<number>` | PR from a branch of this repository | Automatic, on each push |
+
+- `upstream.json` pins the helper, Sentinel, and Traefik versions. A change of `upstream.json` releases nothing. `RELEASE.md` tells how to ship it.
+- The helper image is in [coollabsio/coolify-helper](https://github.com/coollabsio/coolify-helper). Change it there, not in this repository.
 
 <laravel-boost-guidelines>
 === foundation rules ===
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 16e2e14154..6d47cb9a17 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -57,3 +57,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 ### Fixed
 
 - Push nothing but the release index, its images and their attestations, the old workflows pushed every platform image with an index of its own, which stayed behind unused next to the release index on ghcr.io and docker.io
+
+### Maintenance
+
+- Describe the new release process in `AGENTS.md`