diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eed0842..5efdd58 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,25 +1,54 @@
 name: Release
 
-# Triggered by semver tags: git tag v0.3.0 && git push --tags
-# Tag must match the root package.json version.
+# Triggered two ways:
+#   1. Semver tags: git tag v0.3.0 && git push --tags (must match package.json).
+#   2. workflow_run: after the CI workflow succeeds on master, the version in
+#      root package.json is released automatically if no matching tag exists.
 on:
   push:
     tags: ["v*.*.*"]
+  workflow_run:
+    workflows: ["CI"]
+    types: [completed]
+    branches: [master]
 
 permissions:
   contents: write
   packages: write
 
-env:
-  VERSION: ${{ github.ref_name }}
-
 jobs:
   verify:
-    name: Verify tag
+    name: Verify version
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.check.outputs.version }}
+      needed: ${{ steps.check.outputs.needed }}
     steps:
       - uses: actions/checkout@v4
+      - name: Resolve version + decide whether to release
+        id: check
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_run" ]; then
+            if [ "${{ github.event.workflow_run.conclusion }}" != "success" ]; then
+              echo "CI did not succeed — skipping release."
+              echo "needed=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            VERSION="v$(node -p "require('./package.json').version")"
+            if git ls-remote --exit-code --tags origin "refs/tags/$VERSION" > /dev/null 2>&1; then
+              echo "$VERSION already released — nothing to do."
+              echo "needed=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          else
+            VERSION="${{ github.ref_name }}"
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "needed=true" >> "$GITHUB_OUTPUT"
       - name: Check tag matches package versions
+        if: steps.check.outputs.needed == 'true'
+        env:
+          VERSION: ${{ steps.check.outputs.version }}
         run: |
           PKG=$(node -p "require('./package.json').version")
           DESKTOP_PKG=$(node -p "require('./apps/desktop/package.json').version")
@@ -32,6 +61,7 @@ jobs:
   images:
     name: Build + push ${{ matrix.app }}
     needs: verify
+    if: needs.verify.outputs.needed == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -57,7 +87,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ghcr.io/${{ env.GHCR_OWNER }}/primora-${{ matrix.app }}:${{ env.VERSION }}
+            ghcr.io/${{ env.GHCR_OWNER }}/primora-${{ matrix.app }}:${{ needs.verify.outputs.version }}
             ghcr.io/${{ env.GHCR_OWNER }}/primora-${{ matrix.app }}:latest
           cache-from: type=gha,scope=${{ matrix.app }}
           cache-to: type=gha,mode=max,scope=${{ matrix.app }}
@@ -65,6 +95,7 @@ jobs:
   cli-binaries:
     name: Compile ${{ matrix.name }}
     needs: verify
+    if: needs.verify.outputs.needed == 'true'
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -94,6 +125,7 @@ jobs:
   desktop:
     name: Desktop bundle (${{ matrix.name }})
     needs: verify
+    if: needs.verify.outputs.needed == 'true'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -130,6 +162,7 @@ jobs:
   npm-packages:
     name: Pack npm tarballs
     needs: verify
+    if: needs.verify.outputs.needed == 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -151,8 +184,11 @@ jobs:
 
   release:
     name: GitHub Release
-    needs: [images, cli-binaries, desktop, npm-packages]
+    needs: [verify, images, cli-binaries, desktop, npm-packages]
+    if: needs.verify.outputs.needed == 'true'
     runs-on: ubuntu-latest
+    env:
+      VERSION: ${{ needs.verify.outputs.version }}
     steps:
       - uses: actions/checkout@v4
       # build-push-action uploads "*.dockerbuild" metadata artifacts that
@@ -171,6 +207,16 @@ jobs:
         with:
           name: npm-tarballs
           path: dist-release
+      # workflow_run runs leave the release untagged — create it so the
+      # GitHub Release points at a real tag. GITHUB_TOKEN pushes do not
+      # re-trigger workflows, so this cannot recurse.
+      - name: Tag release
+        if: github.event_name == 'workflow_run'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git tag "$VERSION"
+          git push origin "$VERSION"
       - name: Extract changelog section
         run: |
           awk -v ver="${VERSION#v}" '
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 02bf6ec..7505d19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,22 @@
 
 All notable changes to Primora. Format follows [Keep a Changelog](https://keepachangelog.com/); versions follow [SemVer](https://semver.org/).
 
+## [0.7.1] - 2026-09-23
+
+### Fixed
+
+- **Self-hosted sign-up no longer requires mail infrastructure** — `sendTransactionalEmail` warned-and-returned when no transport was configured instead of throwing, so SMTP-less instances 500'd on sign-up. `sendVerificationEmail` now also catches transport failures; a broken SMTP cannot block account creation (verification stays optional).
+- **Password managers detect the login form** — the email/password fields gained `id`/`name` attributes and `label for`/`id` pairing, and the email input uses `autocomplete="username"` (Proton Pass et al.).
+- **Installer prebuilt path strips build blocks** — `install.sh` previously kept `*-build` compose blocks when pulling prebuilt GHCR images.
+
+### Added
+
+- **Static landing page** (`landing/`) — self-contained marketing site with bundled Geist fonts and product screenshots; deployed separately from the app artifacts.
+
+### Infrastructure
+
+- **Automatic releases on merge** — merges to `master` whose root `package.json` version has no matching `v*` tag now trigger the full release pipeline (GHCR images, CLI binaries, desktop bundles, npm tarballs, GitHub Release). Tag pushes still work as before.
+
 ## [0.7.0] - 2026-09-21
 
 ### Changed
diff --git a/apps/desktop/package.json b/apps/desktop/package.json
index 052dda1..f355284 100644
--- a/apps/desktop/package.json
+++ b/apps/desktop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@primora/desktop",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "private": true,
   "description": "Primora desktop shell — thin Tauri client for a self-hosted deployment",
   "scripts": {
diff --git a/apps/desktop/src-tauri/tauri.conf.json b/apps/desktop/src-tauri/tauri.conf.json
index a16413f..06e38ad 100644
--- a/apps/desktop/src-tauri/tauri.conf.json
+++ b/apps/desktop/src-tauri/tauri.conf.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "Primora",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "identifier": "dev.tdvorak.primora",
   "build": {
     "frontendDist": "../ui"
diff --git a/package.json b/package.json
index 58b7446..bc6e4ff 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "primora",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "private": true,
   "packageManager": "npm@9.2.0",
   "workspaces": [