diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 13a606d..e0125e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,14 +9,39 @@ on:
       - "docs/**"
       - "*.md"
       - "LICENSE"
+  # Branch creation. Required because `paths-ignore` on the `push` event
+  # diffs the new ref against the default branch — a branch created from
+  # main with no extra commits has zero diff, so every file matches
+  # paths-ignore and the workflow is skipped. Devs spinning up a personal
+  # branch off main to deploy main's exact state to their dev VM
+  # (`:dev-<user>-latest` floating tag) need an image to be published, so
+  # we trigger explicitly on branch create. Tag creates are filtered out
+  # at the job level so we don't double-build with `keboola-deploy.yml`
+  # (which owns `keboola-deploy-*` tag pushes).
+  create:
   workflow_dispatch:  # manual trigger for explicit dev-<slug> builds
 
 permissions:
   contents: write
   packages: write
 
+# When a developer pushes a brand-new branch with code changes, GitHub fires
+# both a `create` and a `push` event for the same commit. Without
+# concurrency control, both runs would claim distinct CalVer version tags
+# (dev-YYYY.MM.N and dev-YYYY.MM.N+1) and race to push overlapping floating
+# tags (:dev, :dev-<slug>, :dev-<prefix>-latest). Group by ref and cancel
+# in-progress duplicates so only the most recent event survives — the
+# zero-diff case (only `create` fires, no `push`) is unaffected since
+# there's only one run.
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test:
+    # Skip the `create` event for tags — those are owned by keboola-deploy.yml
+    # and shouldn't double-build here. Branch creates DO run.
+    if: github.event_name != 'create' || github.event.ref_type == 'branch'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -38,10 +63,18 @@ jobs:
 
   build-and-push:
     needs: test
-    # Only publish images from main pushes or manual triggers.
-    # Non-main branch pushes run tests only; use workflow_dispatch
-    # for explicit dev-<slug> image builds when needed.
-    if: github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch'
+    # Publish on:
+    #   - any push (main → :stable-* / non-main → :dev-* + :dev-<slug>);
+    #   - branch creation (a fresh branch off main with no extra commits
+    #     should still produce a `:dev-<slug>` + `:dev-<prefix>-latest`
+    #     image so the developer's VM, which pins to that floating tag,
+    #     can deploy main's exact state without manually changing code);
+    #   - manual workflow_dispatch.
+    # Tag creates are excluded — `keboola-deploy.yml` owns tag pushes.
+    if: |
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'create' && github.event.ref_type == 'branch')
     runs-on: ubuntu-latest
     outputs:
       image_tag: ${{ steps.meta.outputs.versioned_tag }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 36e0668..f6ebb37 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ CalVer image tags (`stable-YYYY.MM.N`, `dev-YYYY.MM.N`) are produced for every C
 ### Fixed
 
 - Corporate memory pages (`/corporate-memory`, `/corporate-memory/admin`) now render the shared app header at full viewport width, matching the dashboard. Previously the `_app_header.html` include sat inside `.container-memory` (max-width: 1000px) and was cropped on wide viewports.
+- `release.yml` now publishes a `:dev-<slug>` + `:dev-<prefix>-latest` image when a fresh branch is pushed off `main` with no extra commits. Pre-fix, `paths-ignore` on the `push` event diffed the new ref against the default branch — a same-SHA branch had zero diff, every file matched paths-ignore, and the workflow was skipped, so a developer creating a personal branch off main to deploy main's exact state to their dev VM (which pins to `:dev-<user>-latest`) had to either commit something or trigger the workflow manually. The `build-and-push` job's `if` was also tightened to `main || workflow_dispatch` only, which prevented branch-push images regardless. Both fixed: added `create:` trigger (filtered to branch refs at the job level so tag creates don't double-build with `keboola-deploy.yml`), and broadened `build-and-push.if` to also publish on non-main branch pushes / branch creates.
 
 ## [0.15.0] — 2026-04-29