diff --git a/Makefile b/Makefile
index ab75f0b..062f87f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,12 @@
 PACKAGE  = github.com/utilitywarehouse/k8s-sidecar-injector
 BINARY   = k8s-sidecar-injector
+IMAGE    = quay.io/utilitywarehouse/k8s-sidecar-injector
 DATE    ?= $(shell date +%FT%T%z)
 BRANCH  ?= $(shell git rev-parse --abbrev-ref HEAD)
 COMMIT  ?= $(shell git rev-parse HEAD)
 VERSION ?= $(shell git describe --tags --always --dirty --match=v* 2> /dev/null || \
 			cat $(CURDIR)/.version 2> /dev/null || echo v0)
+
 BIN      = $(GOPATH)/bin
 PKGS     = $(or $(PKG),$(shell $(GO) list ./...))
 TESTPKGS = $(shell env $(GO) list -f '{{ if or .TestGoFiles .XTestGoFiles }}{{ .ImportPath }}{{ end }}' $(PKGS))
@@ -117,3 +119,11 @@ help:
 .PHONY: version
 version:
 	@echo $(VERSION)
+
+release:
+	@sd "$(IMAGE):latest" "$(IMAGE):$(VERSION)" $$(rg -l -- $(IMAGE) manifests/)
+	@git add -- manifests/
+	@git commit -m "Release $(VERSION)"
+	@sd "$(IMAGE):$(VERSION)" "$(IMAGE):latest" $$(rg -l -- "$(IMAGE)" manifests/)
+	@git add -- manifests/
+	@git commit -m "Clean up release $(VERSION)"
diff --git a/README.md b/README.md
index e286389..1419233 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,6 @@ endpoints         |                                                      | load
           +----------------+
 ```
 
-
 # Run
 
 The image is built and published on [Quay](https://quay.io/repository/utilitywarehouse/k8s-sidecar-injector). See [the example](/manifests/example) for how to run this in Kubernetes.
@@ -58,12 +57,22 @@ The image is built and published on [Quay](https://quay.io/repository/utilitywar
 $ ./bin/k8s-sidecar-injector --tls-port=9000 --config-directory=conf/ --tls-cert-file="${TLS_CERT_FILE}" --tls-key-file="${TLS_KEY_FILE}"
 ```
 
-*NOTE*: this is not a supported method of running in production. You are highly encouraged to deploy this to Kubernetes in [The Supported Way](/manifests/example).
+_NOTE_: this is not a supported method of running in production. You are highly encouraged to deploy this to Kubernetes in [The Supported Way](/manifests/example).
 
 # Hacking
 
 See [hacking.md](/docs/hacking.md)
 
+# Updating
+
+Run `make release VERSION=<version>` to create a new release.
+This will create a commit which updates the image in the deployment manifests
+and another which reverts the image tag to 'latest'. Tag the former commit
+with the release version.
+
+This ensures that the release tag points to manifests that include the
+corresponding image version but the `master` branch gives you the `latest` tag.
+
 # License
 
 [Apache 2.0](/LICENSE.txt)
diff --git a/manifests/base/k8s-sidecar-injector.yaml b/manifests/base/k8s-sidecar-injector.yaml
index 1040ca6..2de7110 100644
--- a/manifests/base/k8s-sidecar-injector.yaml
+++ b/manifests/base/k8s-sidecar-injector.yaml
@@ -85,7 +85,7 @@ spec:
             secretName: k8s-sidecar-injector-webhook-server-cert
       containers:
         - name: "k8s-sidecar-injector"
-          image: quay.io/utilitywarehouse/k8s-sidecar-injector:v0.7.1
+          image: quay.io/utilitywarehouse/k8s-sidecar-injector:latest
           command: ["entrypoint.sh"]
           args: []
           ports: