diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 9a6c97fe65..3683bd9f8c 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -6,10 +6,10 @@
 # - Manual workflow dispatch
 #
 # Images published:
-# - ruvector/ruvector-postgres:latest
-# - ruvector/ruvector-postgres:2.0.0
-# - ruvector/ruvector-postgres:2.0.0-pg17
-# - ruvector/ruvector-postgres:pg17
+# - ruvnet/ruvector-postgres:latest
+# - ruvnet/ruvector-postgres:2.0.0
+# - ruvnet/ruvector-postgres:2.0.0-pg17
+# - ruvnet/ruvector-postgres:pg17
 # - (Same for pg14, pg15, pg16)
 
 name: Docker Hub Publish
@@ -20,18 +20,18 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Version to publish (e.g., 2.0.0)'
+        description: 'Version to publish (e.g., 2.0.6)'
         required: true
-        default: '2.0.0'
+        default: '2.0.6'
       pg_versions:
         description: 'PostgreSQL versions (comma-separated)'
         required: false
         default: '14,15,16,17'
 
 env:
-  DOCKER_REGISTRY: ruvector
+  DOCKER_REGISTRY: ruvnet
   IMAGE_NAME: ruvector-postgres
-  RUST_VERSION: '1.83'
+  RUST_VERSION: '1.86'
 
 jobs:
   # ============================================================================
@@ -40,6 +40,9 @@ jobs:
   build-and-push:
     name: Build & Push PG${{ matrix.pg_version }}
     runs-on: ubuntu-latest
+    # Only postgres releases (tag ruvector-postgres-vX.Y.Z) or manual dispatch;
+    # other releases in this repo (esp32, rvf, crates) must not move :latest.
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.event.release.tag_name, 'ruvector-postgres-v')
     permissions:
       contents: read
       packages: write
@@ -58,7 +61,7 @@ jobs:
         run: |
           if [ "${{ github.event_name }}" == "release" ]; then
             VERSION="${{ github.event.release.tag_name }}"
-            VERSION="${VERSION#v}"
+            VERSION="${VERSION#ruvector-postgres-v}"
           else
             VERSION="${{ github.event.inputs.version }}"
           fi
@@ -74,8 +77,8 @@ jobs:
       - name: Log in to Docker Hub
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ env.DOCKER_REGISTRY }}
+          password: ${{ secrets.DOCKER_PERSONAL_ACCESS_TOKEN }}
 
       - name: Log in to GitHub Container Registry
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9
@@ -156,8 +159,8 @@ jobs:
       - name: Update Docker Hub description
         uses: peter-evans/dockerhub-description@432a30c9e07499fd01da9f8a49f0faf9e0ca5b77
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          username: ${{ env.DOCKER_REGISTRY }}
+          password: ${{ secrets.DOCKER_PERSONAL_ACCESS_TOKEN }}
           repository: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
           readme-filepath: crates/ruvector-postgres/docker/README.md
           short-description: "RuVector v2 - High-performance PostgreSQL vector extension with 230+ SQL functions, SIMD, Flash Attention, GNN, hybrid search"
diff --git a/crates/ruvector-postgres/docker/Dockerfile b/crates/ruvector-postgres/docker/Dockerfile
index f0453e842d..eb75ca7433 100644
--- a/crates/ruvector-postgres/docker/Dockerfile
+++ b/crates/ruvector-postgres/docker/Dockerfile
@@ -1,7 +1,7 @@
 # RuVector-Postgres Development & Testing Dockerfile
 # Multi-stage build with PostgreSQL version support (14-17)
 # Default: PostgreSQL 17 (latest with pgrx 0.12 support)
-# v0.3.1: Fixes — Cypher self-reference, graph/RDF persistence, SONA dimension panic
+# v2.0.6: index and SONA integrity fixes
 
 ARG PG_VERSION=17
 ARG RUST_VERSION=1.86
@@ -30,8 +30,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     git \
     && rm -rf /var/lib/apt/lists/*
 
-# Install pgrx (compatible with pgrx = "0.12" in Cargo.toml)
-RUN cargo install cargo-pgrx --version 0.12.6 --locked
+# Install pgrx (must match the pgrx version pinned in Cargo.lock)
+RUN cargo install cargo-pgrx --version 0.12.9 --locked
 
 # Initialize pgrx for the specified PostgreSQL version
 RUN cargo pgrx init --pg${PG_VERSION} /usr/lib/postgresql/${PG_VERSION}/bin/pg_config
@@ -87,7 +87,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "2.0.4"
+version = "2.0.6"
 edition = "2021"
 rust-version = "1.77"
 license = "MIT"
@@ -144,6 +144,10 @@ COPY crates/ruvector-postgres/src ./src/
 COPY crates/ruvector-postgres/sql ./sql/
 COPY crates/ruvector-postgres/benches ./benches/
 
+# Pin dependency versions; without a lockfile cargo resolves the newest crates,
+# which can require a newer rustc than RUST_VERSION.
+COPY crates/ruvector-postgres/Cargo.lock /build/Cargo.lock
+
 # Build the extension with all features including v0.3 modules
 # graph-complete includes: graph, hyperbolic, sparse
 RUN cargo pgrx package \
@@ -187,9 +191,9 @@ ENV PG_VERSION=${PG_VERSION}
 ENV POSTGRES_INITDB_ARGS="--data-checksums"
 
 # Labels for version tracking
-LABEL org.opencontainers.image.title="RuVector PostgreSQL Extension v0.3.1"
+LABEL org.opencontainers.image.title="RuVector PostgreSQL Extension v2.0.6"
 LABEL org.opencontainers.image.description="High-performance vector database extension for PostgreSQL with 270+ SQL functions, Graph/Cypher/SPARQL, GNN, hybrid search, multi-tenancy, self-healing, SONA self-learning, Solver, Math, TDA, and Domain Expansion"
-LABEL org.opencontainers.image.version="0.3.1"
+LABEL org.opencontainers.image.version="2.0.6"
 LABEL org.opencontainers.image.vendor="ruv.io"
 LABEL org.opencontainers.image.source="https://github.com/ruvnet/ruvector"
 LABEL ruvector.pg.version="${PG_VERSION}"