diff --git a/README.md b/README.md
index cfcb2bb4..cc0e194b 100644
--- a/README.md
+++ b/README.md
@@ -76,11 +76,13 @@ For a home server, a NAS, or a single small studio, the all-in-one image runs th
 docker run -d --name picpeak -p 3000:3000 \
   -v picpeak:/data \
   -e JWT_SECRET="$(openssl rand -base64 48)" \
-  ghcr.io/picpeak/picpeak/aio:stable
+  ghcr.io/picpeak/picpeak/aio:main
 ```
 
 Then open **http://localhost:3000/admin** and read the setup token with `docker exec picpeak cat /data/db/SETUP_TOKEN`.
 
+`:main` is the active-development tag, and today it is the only one the all-in-one image has — `Dockerfile.aio` landed after the current stable release, so `:stable` and `:latest` first appear for this image once the aio build reaches the `stable` branch. Switch to `:stable` then, or pin a version tag (`3.107.4-beta.0`) if you would rather not track `main`.
+
 The compose stack above is still the right choice for anything busier — SQLite takes one writer at a time, and Postgres is what scales. You can move to it later without reinstalling: take a `.picpeak` backup and restore it into the full stack. See **[Single-container install](https://docs.picpeak.app/deployment/single-container)** for the volume layout, the external-Postgres variant, TLS, and the limits.
 
 ### Docker images