diff --git a/VERSION b/VERSION
new file mode 100644
index 0000000..18fa8e7
--- /dev/null
+++ b/VERSION
@@ -0,0 +1 @@
+v1.3.0
diff --git a/docker/ours-rp-metrics.Dockerfile b/docker/ours-rp-metrics.Dockerfile
index f7abee5..035b326 100644
--- a/docker/ours-rp-metrics.Dockerfile
+++ b/docker/ours-rp-metrics.Dockerfile
@@ -139,7 +139,7 @@ ARG SOURCE_DIRTY=unknown
 ARG BUILD_TIMESTAMP_UTC=unknown
 ARG RPKI_CLIENT_VERSION=9.8
 
-LABEL org.opencontainers.image.title="ours-rp-metrics" \
+LABEL org.opencontainers.image.title="panda-rpki-metrics" \
       org.opencontainers.image.description="Ours RP artifact metrics image for multi-arch Docker Compose deployment" \
       org.opencontainers.image.revision="${SOURCE_COMMIT}" \
       org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
diff --git a/docker/ours-rp-runtime.Dockerfile b/docker/ours-rp-runtime.Dockerfile
index 9e30e8e..2122bf3 100644
--- a/docker/ours-rp-runtime.Dockerfile
+++ b/docker/ours-rp-runtime.Dockerfile
@@ -124,7 +124,7 @@ ARG SOURCE_COMMIT=unknown
 ARG SOURCE_DIRTY=unknown
 ARG BUILD_TIMESTAMP_UTC=unknown
 
-LABEL org.opencontainers.image.title="ours-rp-runtime" \
+LABEL org.opencontainers.image.title="panda-rpki-rp" \
       org.opencontainers.image.description="Ours RP runtime image for multi-arch Docker Compose deployment" \
       org.opencontainers.image.revision="${SOURCE_COMMIT}" \
       org.opencontainers.image.created="${BUILD_TIMESTAMP_UTC}" \
diff --git a/scripts/docker/build_docker_installer_package.sh b/scripts/docker/build_docker_installer_package.sh
index 51831d2..32c5d3d 100755
--- a/scripts/docker/build_docker_installer_package.sh
+++ b/scripts/docker/build_docker_installer_package.sh
@@ -5,6 +5,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
 TARGET_ARCH="${TARGET_ARCH:-}"
+VERSION="${VERSION:-}"
 IMAGE_TAG=""
 IMAGE_TAR=""
 METRICS_IMAGE=""
@@ -25,6 +26,10 @@ Usage:
 
 Options:
   --arch <arch>       Target architecture: amd64|arm64
+  --version <vX.Y.Z>  Component version for image tags and the package name.
+                      Default: contents of the VERSION file at the repo root.
+                      Release builds (without --allow-dirty) require a git tag
+                      matching this version pointing at HEAD.
   --prometheus-image <tag>
                       Prometheus image tag to record and package.
   --prometheus-image-tar <path>
@@ -42,7 +47,7 @@ Options:
   -h, --help          Show help.
 
 Every package rebuilds runtime and metrics images from the current HEAD. Their
-tags are ours-rp-runtime-<arch>:<git8> and ours-rp-metrics-<arch>:<git8>.
+tags are panda-rpki-rp-<arch>:<version> and panda-rpki-metrics-<arch>:<version>.
 External runtime/metrics image tags and tar archives are intentionally rejected.
 USAGE
 }
@@ -72,17 +77,17 @@ safe_tag_name() {
 runtime_image_tag() {
   local arch="$1"
   local revision="$2"
-  printf 'ours-rp-runtime-%s:%s\n' "$arch" "$revision"
+  printf 'panda-rpki-rp-%s:%s\n' "$arch" "$revision"
 }
 
 metrics_image_tag() {
   local arch="$1"
   local revision="$2"
-  printf 'ours-rp-metrics-%s:%s\n' "$arch" "$revision"
+  printf 'panda-rpki-metrics-%s:%s\n' "$arch" "$revision"
 }
 
 default_package_prefix() {
-  printf 'ours-rp-installer-%s\n' "$1"
+  printf 'panda-rpki-rp-installer-%s\n' "$1"
 }
 
 default_host_data_dir() {
@@ -180,6 +185,10 @@ while [[ $# -gt 0 ]]; do
       }
       shift 2
       ;;
+    --version)
+      VERSION="$2"
+      shift 2
+      ;;
     --image|--image-tar|--metrics-image|--metrics-image-tar)
       echo "$1 is no longer supported: installer packages always rebuild runtime and metrics images from current HEAD" >&2
       exit 2
@@ -254,8 +263,36 @@ will be explicitly marked dirty.
 EOF
   exit 2
 fi
+
+# 版本来源：--version 覆盖，默认读仓库根 VERSION 文件。release 构建要求
+# HEAD 已打同版 git tag（自研组件打包前打 tag，与容器镜像 tag 保持一致）。
+if [[ -z "$VERSION" ]]; then
+  [[ -f "$REPO_ROOT/VERSION" ]] || {
+    echo "missing VERSION file at $REPO_ROOT/VERSION; pass --version <vX.Y.Z> or create it" >&2
+    exit 2
+  }
+  VERSION="$(tr -d '[:space:]' < "$REPO_ROOT/VERSION")"
+fi
+[[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]] || {
+  echo "invalid version '$VERSION' (expected vX.Y.Z)" >&2
+  exit 2
+}
+GIT_TAG_AT_HEAD=""
+if [[ "$ALLOW_DIRTY" != "1" ]]; then
+  GIT_TAG_AT_HEAD="$(git -C "$REPO_ROOT" tag --points-at HEAD | grep -Fx "$VERSION" || true)"
+  [[ -n "$GIT_TAG_AT_HEAD" ]] || {
+    cat >&2 <<EOF
+refusing to build a release installer: HEAD is not tagged with '$VERSION'.
+Create the tag first so the git tag matches the container image tag:
+  git -C $REPO_ROOT tag -a $VERSION -m "release $VERSION"
+Use --allow-dirty only for development verification (skips this check).
+EOF
+    exit 2
+  }
+fi
+
 TIMESTAMP="$(date -u +%Y%m%dT%H%M%SZ)"
-REVISION_TOKEN="$SOURCE_COMMIT_SHORT"
+REVISION_TOKEN="$VERSION"
 if [[ "$SOURCE_DIRTY" == "true" ]]; then
   REVISION_TOKEN="${REVISION_TOKEN}-dirty"
 fi
@@ -367,6 +404,8 @@ package_schema_version=2
 package_name=$package_name
 created_at_utc=$TIMESTAMP
 build_timestamp_utc=$TIMESTAMP
+version=$VERSION
+git_tag=${GIT_TAG_AT_HEAD:-}
 source_commit=$SOURCE_COMMIT_FULL
 source_commit_short=$SOURCE_COMMIT_SHORT
 source_dirty=$SOURCE_DIRTY
@@ -419,6 +458,8 @@ EOF
 
 cat > "$stage/PACKAGE-SUMMARY.txt" <<EOF
 package_name: $package_name
+version: $VERSION
+git_tag: ${GIT_TAG_AT_HEAD:-}
 source_commit: $SOURCE_COMMIT_FULL
 source_commit_short: $SOURCE_COMMIT_SHORT
 source_dirty: $SOURCE_DIRTY
diff --git a/scripts/docker/build_docker_metrics_image.sh b/scripts/docker/build_docker_metrics_image.sh
index 38848b0..1e5d6e9 100755
--- a/scripts/docker/build_docker_metrics_image.sh
+++ b/scripts/docker/build_docker_metrics_image.sh
@@ -69,7 +69,7 @@ if [[ -z "$IMAGE_TAG" ]]; then
   if [[ -n "$(git -C "$REPO_ROOT" status --short 2>/dev/null)" ]]; then
     SOURCE_COMMIT_SHORT="${SOURCE_COMMIT_SHORT}-dirty"
   fi
-  IMAGE_TAG="ours-rp-metrics-${TARGET_ARCH}:${SOURCE_COMMIT_SHORT}"
+  IMAGE_TAG="panda-rpki-metrics-${TARGET_ARCH}:${SOURCE_COMMIT_SHORT}"
 fi
 
 if [[ "$dockerfile_explicit" != "1" ]]; then
diff --git a/scripts/docker/build_docker_runtime_image.sh b/scripts/docker/build_docker_runtime_image.sh
index 271b094..a28fed7 100755
--- a/scripts/docker/build_docker_runtime_image.sh
+++ b/scripts/docker/build_docker_runtime_image.sh
@@ -22,7 +22,7 @@ Usage:
 
 Options:
   --arch <arch>       Target architecture: amd64|arm64
-  --image <tag>       Docker image tag (default: ours-rp-runtime-<arch>:<git8>)
+  --image <tag>       Docker image tag (default: panda-rpki-rp-<arch>:<git8>)
   --out-dir <path>    Directory for docker save tar.gz (default: target/<arch>-docker)
   --dockerfile <path> Dockerfile path
   --builder <name>    buildx builder name
@@ -69,7 +69,7 @@ platform_for_arch() {
 default_image_tag() {
   local arch="$1"
   local commit_short="$2"
-  printf 'ours-rp-runtime-%s:%s\n' "$arch" "$commit_short"
+  printf 'panda-rpki-rp-%s:%s\n' "$arch" "$commit_short"
 }
 
 require_command() {