diff --git a/.dockerignore b/.dockerignore
index b512c09..d44777c 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1 +1,5 @@
-node_modules
\ No newline at end of file
+coverage/
+node_modules/
+.DS_Store
+azure-pipelines.yml
+*.azcli
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 4bcdeba..fc7690f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 coverage/
 node_modules/
 .DS_Store
+*.azcli
\ No newline at end of file
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 461e6ec..0ec1597 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -2,8 +2,9 @@
 name: $(BuildID)
 
 trigger:
-  - master
   - feat/*
+  - master
+  - release
 
 schedules:
   - cron: "0 12 * * 0"
@@ -25,12 +26,14 @@ variables:
   - name: app-services-name
     value: azure-nodejs-demo
 
-  # Pattern: registry.azurecr.io/demos/app-name:12-gitsha
   - name: image-name
-    value: $(registry-host)/$(registry-namespace)/$(app-name)
+    value: $(registry-namespace)/$(app-name)
+
+  - name: image-name-with-registry
+    value: $(registry-host)/$(image-name) # e.g. registry.azurecr.io/demos/app-name
 
   - name: image-tag
-    value: $(Build.BuildId)-$(Build.SourceVersion)
+    value: $(Build.BuildId)-$(Build.SourceVersion) # e.g. 12-gitsha
 
 stages:
 - stage: Tests
@@ -70,7 +73,15 @@ stages:
       displayName: Build and Push Image
       steps:
 
-      - script: docker build --tag $(image-name):$(image-tag) .
+      # release: set version to package.json version
+      - script: |
+          echo '##vso[task.setvariable variable=image-tag]'$(npm run --silent project-version)''
+          echo 'Project version is $(image-tag)'
+          echo 'Image tag set to $(image-tag)'
+        displayName: 'Overwrite image tag if `release` branch'
+        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/release'), ne(variables['Build.Reason'], 'Schedule'))
+
+      - script: docker build --tag $(image-name-with-registry):$(image-tag) .
         displayName: 'Docker: Build and tag image'
 
       - task: Docker@1
@@ -81,6 +92,20 @@ stages:
           imageName: $(image-name):$(image-tag)
           command: push
 
+      # release: lock image
+      - task: AzureCLI@2
+        displayName: 'Lock release image, preventing delete'
+        inputs:
+          azureSubscription:  $(registry-service-connection)
+          scriptType: bash
+          scriptLocation: inlineScript
+          inlineScript: |
+              az --version
+              az acr repository update \
+                --name $(registry-acr-name) --image $(image-name):$(image-tag) \
+                --write-enabled false
+        condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/release'), ne(variables['Build.Reason'], 'Schedule'))
+
 # ----------------------------
 # Deploy to Azure App Services
 # ----------------------------
diff --git a/package.json b/package.json
index 578dc41..4ecde9f 100644
--- a/package.json
+++ b/package.json
@@ -13,6 +13,7 @@
     "start": "node app/server.js",
     "dev": "NODE_ENV=development nodemon -w app app/server.js",
     "lint": "eslint .",
+    "my-version": "node -e \"console.log(require('./package.json').version)\"",
     "release": "standard-version",
     "test": "jest",
     "test:watch": "jest --watch",