diff --git a/release/README.md b/release/README.md
index 97632a36c..1b8614ead 100644
--- a/release/README.md
+++ b/release/README.md
@@ -29,9 +29,11 @@ These steps assume you are on the correct branch and have a git remote called `o
   `brew bump-formula-pr --url https://github.com/mitmproxy/mitmproxy/archive/v<version number here>`
 
 ### Docker
-- The docker image is built on Travis and pushed to Docker Hub automatically.
-- Please check https://hub.docker.com/r/mitmproxy/mitmproxy/tags/ about the latest version.
-- Update `latest` tag: `export VERSION=4.0.3 && docker pull mitmproxy/mitmproxy:$VERSION && docker tag mitmproxy/mitmproxy:$VERSION mitmproxy/mitmproxy:latest && docker push mitmproxy/mitmproxy:latest`.
+- The docker image is built by our CI workers and pushed to Docker Hub automatically.
+- Please verify that https://hub.docker.com/r/mitmproxy/mitmproxy/tags/ has the latest version.
+- The latest and latest-ARMv7 tags should auto-update. @mhils introduced this after the 5.0.0 release.
+  Please verify that this is the case and remove this notice. For reference, this is how to do it manually:
+  `export VERSION=4.0.3 && docker pull mitmproxy/mitmproxy:$VERSION && docker tag mitmproxy/mitmproxy:$VERSION mitmproxy/mitmproxy:latest && docker push mitmproxy/mitmproxy:latest`.
 
 ### Docs
   - `./build-current`. If everything looks alright, continue with
diff --git a/release/cibuild.py b/release/cibuild.py
index 46066099e..b2bad9a0c 100755
--- a/release/cibuild.py
+++ b/release/cibuild.py
@@ -569,8 +569,11 @@ def upload():  # pragma: no cover
             "-u", be.docker_username,
             "-p", be.docker_password,
         ])
-        subprocess.check_call(["docker", "push", be.docker_tag])
-        subprocess.check_call(["docker", "push", be.docker_tag + "-ARMv7"])
+        for variant in ["", "-ARMv7"]:
+            subprocess.check_call(["docker", "push", be.docker_tag + variant])
+            if be.is_prod_release:
+                subprocess.check_call(["docker", "tag", be.docker_tag + variant, "mitmproxy/mitmproxy:latest" + variant])
+                subprocess.check_call(["docker", "push", "mitmproxy/mitmproxy:latest" + variant])
 
 
 if __name__ == "__main__":  # pragma: no cover