diff --git a/.github/workflows/bundle.yml b/.github/workflows/bundle.yml
index 90b3c03..1fc7a7b 100644
--- a/.github/workflows/bundle.yml
+++ b/.github/workflows/bundle.yml
@@ -1,7 +1,11 @@
-# Builds the single-file wizard (.github/tools/bundle.sh) and publishes it as the
-# asset of the rolling "latest" release, for:
+# Builds the single-file wizard (.github/tools/bundle.sh) and publishes it as a
+# release per version: tag v$VERSION (VERSION in setup-gamescope-boot.sh),
+# with that version's CHANGELOG.md section as notes. A released version is
+# never overwritten; the newest one is marked latest, and the "latest" tag and
+# release are moved to it, so both of these always get the newest version:
+#   curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/latest/download/setup-gamescope-boot.sh | bash
 #   curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/download/latest/setup-gamescope-boot.sh | bash
-# Pull requests only build and check it.
+# Pull requests only build and check it, and warn when VERSION is already released.
 name: Single-file build
 
 on:
@@ -35,29 +39,50 @@ jobs:
           name: setup-gamescope-boot
           path: dist/setup-gamescope-boot.sh
 
-      - name: Publish to the "latest" release
-        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+      - name: Version
+        id: version
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           version="$(grep -oP '^VERSION=\K.*' setup-gamescope-boot.sh)"
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          if gh release view "v$version" >/dev/null 2>&1; then
+            echo "released=true" >> "$GITHUB_OUTPUT"
+            echo "::warning::v$version is already released and won't be overwritten. Bump VERSION in setup-gamescope-boot.sh and add a CHANGELOG.md section to release this."
+          else
+            echo "released=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Publish the v${{ steps.version.outputs.version }} release
+        if: >-
+          github.event_name != 'pull_request' && github.ref == 'refs/heads/main' &&
+          steps.version.outputs.released == 'false'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
           # This version's section of CHANGELOG.md, without its heading.
-          changes="$(awk -v v="$version" '
+          changes="$(awk -v v="$VERSION" '
               $0 ~ "^## " { if (found) exit; if (index($0, "## " v " ") == 1) { found = 1; next } }
               found' CHANGELOG.md)"
-          notes="Single-file build of v$version ($(git describe --always), $(git log -1 --format=%cs)).
-          Run it with:
+          notes="Single-file build of v$VERSION ($(git describe --always), $(git log -1 --format=%cs)).
+          Run the newest version with:
 
-              curl -fsSL https://github.com/${{ github.repository }}/releases/download/latest/setup-gamescope-boot.sh | bash
+              curl -fsSL https://github.com/${{ github.repository }}/releases/latest/download/setup-gamescope-boot.sh | bash
 
-          ## Changes in v$version
+          ## Changes in v$VERSION
           $changes"
-          title="Latest single-file build (v$version)"
+          gh release create "v$VERSION" dist/setup-gamescope-boot.sh \
+              --target "$GITHUB_SHA" --title "v$VERSION" --notes "$notes" --latest
+
+          # "latest" follows the newest version tag, for the older install URL
+          # (.../releases/download/latest/...). Only moved when a new version
+          # is released, never for a push without a VERSION bump.
+          git tag -f latest "$GITHUB_SHA" && git push -f origin latest
+          latest_notes="Always the newest version, currently v$VERSION (see its release for the changes)."
           if gh release view latest >/dev/null 2>&1; then
-            gh release edit latest --title "$title" --notes "$notes"
+            gh release edit latest --title "Latest (v$VERSION)" --notes "$latest_notes" --latest=false
           else
-            gh release create latest --title "$title" --notes "$notes" --latest
+            gh release create latest --title "Latest (v$VERSION)" --notes "$latest_notes" --latest=false
           fi
-          # Move the tag to this commit and replace the asset.
-          git tag -f latest && git push -f origin latest
           gh release upload latest dist/setup-gamescope-boot.sh --clobber
diff --git a/AGENTS.md b/AGENTS.md
index 3c16209..80da0f5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -35,8 +35,9 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
   the entry point's `for lib in ...; do` source loop and wraps everything
   after that loop in `main()`. Keep that loop on one line, keep all logic in
   functions, and don't rely on `SCRIPT_DIR` for anything but sourcing.
-  CI (`.github/workflows/bundle.yml`) publishes the bundle to the `latest`
-  release on pushes to `main`.
+  CI (`.github/workflows/bundle.yml`) publishes the bundle as release
+  `v$VERSION` on pushes to `main`; an existing version is never overwritten,
+  so bump `VERSION` for every release.
 
 ## Conventions
 
@@ -58,9 +59,21 @@ gamescope and the Plasma desktop. Primary target: the Valve Steam Machine
 - Comments explain *why* (the CachyOS/Plasma quirk being worked around),
   not what the next line does.
 
-- **Versioning.** SemVer in `VERSION` (`setup-gamescope-boot.sh`, shown in
-  the menu header and the bundle). Every commit gets an entry in
-  `CHANGELOG.md` under its version; a new PR/branch bumps the version.
+- **Versioning and releases.** SemVer in `VERSION` (`setup-gamescope-boot.sh`,
+  shown in the menu header and the bundle header).
+  - Every commit gets an entry in `CHANGELOG.md` under its version (short hash
+    + subject; a commit can't contain its own hash, so fill it in with the
+    next commit). The section heading must be `## <VERSION> - <date>`: CI
+    cuts the release notes out of the changelog by that heading.
+  - Every PR that should be released bumps `VERSION` and adds its section.
+    A push to `main` publishes release `v$VERSION` (tag + bundle + that
+    changelog section) and marks it latest. An existing version is never
+    overwritten: without a bump nothing is released, and pull requests show
+    a warning.
+  - Users install through `releases/latest/download/setup-gamescope-boot.sh`
+    (GitHub's newest release). The `latest` tag and release follow the newest
+    version tag too (moved, asset replaced, when a new version is released),
+    so the older URL `releases/download/latest/...` keeps working.
 
 ## Non-obvious behaviour to preserve
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b15d4d2..39bb60e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -44,7 +44,18 @@ Machine LED driver works on every installed kernel and survives kernel updates.
   - Fix a shellcheck warning in the bundle (a variable name shared with
     `lib/state.sh`), which would have failed the CI check.
 - `d7231eb` **chore: Move the bundle tool to .github/tools/bundle.sh**
-- **docs: Commit hashes in the changelog**
+- `5c00504` **docs: Commit hashes in the changelog**
+- `8aab946` **ci: A release per version (tag v0.7.0, ...) instead of overwriting "latest"**
+  - Each push to `main` publishes release `v$VERSION` with that version's
+    changelog; an already released version is never overwritten (pull requests
+    get a warning when `VERSION` wasn't bumped).
+  - Install with `.../releases/latest/download/setup-gamescope-boot.sh`, which
+    always points to the newest release.
+- `1604ed1` **docs: Versioning and release rules in AGENTS.md**
+- **ci: The latest tag follows the newest version tag**
+  - When a new version is released, the `latest` tag and release move to it
+    (bundle replaced), so the older `.../releases/download/latest/...` URL
+    also always gives the newest version.
 
 ## 0.6.2 - 2026-09-23
 
diff --git a/README.md b/README.md
index b8e3f8c..215d969 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ Everything you turn off is put back the way it was.
 Open **Konsole** on your Plasma desktop and run:
 
 ```bash
-curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/download/latest/setup-gamescope-boot.sh | bash
+curl -fsSL https://github.com/theupriser/cachyos-gamescope-boot/releases/latest/download/setup-gamescope-boot.sh | bash
 ```
 
 That downloads and runs the latest single-file version, and works in any
@@ -334,7 +334,9 @@ gamescope-session, ...) stay installed.
 
 The single-file version is generated: on every push to `main`, GitHub
 Actions runs `.github/tools/bundle.sh`, checks the result with `bash -n` and
-shellcheck, and uploads it to the rolling `latest` release. It inlines
+shellcheck, and publishes it as a release per version (tag `v<VERSION>`,
+never overwritten; the newest is marked latest, and the `latest` tag follows
+it). It inlines
 `lib/*.sh` and wraps the entry point in `main()`, so bash has read the whole
 file before anything runs; when stdin is a pipe (`curl | bash`) it reattaches
 the terminal for the menu (set `WIZARD_KEEP_STDIN=1` to keep piped input).