diff --git a/Dockerfile b/Dockerfile
index a4785ac..a5d82b7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # ---- Build stage ----
-FROM golang:1.22-alpine AS builder
+FROM golang:1.25-alpine AS builder
 
 WORKDIR /src
 COPY go.mod go.sum ./
@@ -7,6 +7,7 @@ RUN go mod download
 
 COPY . .
 RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /bin/davserver ./cmd/server
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /bin/nidusctl ./tools/nidusctl
 
 # ---- Runtime stage ----
 FROM alpine:3.19
@@ -15,10 +16,14 @@ RUN apk add --no-cache ca-certificates tzdata
 WORKDIR /app
 
 COPY --from=builder /bin/davserver /usr/local/bin/davserver
+COPY --from=builder /bin/nidusctl /usr/local/bin/nidusctl
 
 # Default data and config locations
 VOLUME ["/app/data"]
-COPY config.yaml /app/config.yaml
+# config.yaml itself is git-ignored (it holds real secrets), so the image
+# ships the example config as a working default; mount your own
+# config.yaml over /app/config.yaml (see docker-compose.yaml) to override it.
+COPY config.example.yaml /app/config.yaml
 
 EXPOSE 8080
 
diff --git a/README.md b/README.md
index baf7ada..f661794 100644
--- a/README.md
+++ b/README.md
@@ -90,31 +90,33 @@ docker run -p 8080:8080 \
   davserver
 ```
 
----
+The image also ships `nidusctl`, so once the container is running you can
+create your first user (and their calendars/address books) with
+`docker compose exec` — no need to install Go locally:
 
-## Client configuration
+```bash
+docker compose exec davserver nidusctl -config /app/config.yaml user create alice \
+  --display-name "Alice Smith" --email alice@example.com
+# (prompts for a password; use --password to skip the prompt, e.g. in scripts)
 
-### Apple Calendar / Contacts (macOS / iOS)
+docker compose exec davserver nidusctl -config /app/config.yaml calendar create alice personal
+docker compose exec davserver nidusctl -config /app/config.yaml addressbook create alice contacts
+```
 
-1. Go to **Settings → Calendar → Accounts → Add Account → Other → Add CalDAV Account**
-2. Enter:
-   - **Server**: `http://yourserver:8080`
-   - **Username**: `alice`
-   - **Password**: your plaintext password
-3. The app will auto-discover calendars at `/cal/`.
+### Pre-built images
 
-Same flow for **CardDAV** with Contacts app.
+Pushing a version tag (e.g. `v1.2.3`) or publishing a release triggers
+[`.github/workflows/docker-release.yml`](.github/workflows/docker-release.yml),
+which builds and publishes a multi-arch (`linux/amd64` + `linux/arm64`)
+image to this repository's own container registry, tagged with both the
+version and `latest`. Point `docker-compose.yaml`'s `image:` at it instead
+of `build: .` to use it directly, e.g.:
 
-### Thunderbird
-
-1. Install the **TbSync** add-on + **CalDAV & CardDAV** provider
-2. Add a new account and point it at `http://yourserver:8080/.well-known/caldav`
-
-### GNOME Calendar / Evolution
-
-Use the GNOME Online Accounts panel:
-- **Server**: `http://yourserver:8080`
-- Check *CalDAV* / *CardDAV* as appropriate
+```yaml
+services:
+  davserver:
+    image: <registry>/<owner>/<repo>:latest
+```
 
 ---