diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
new file mode 100644
index 0000000..7367a4a
--- /dev/null
+++ b/.github/workflows/release-please.yml
@@ -0,0 +1,115 @@
+name: release-please
+
+# Single release workflow (ADR-0002, ADR-0003).
+#
+# On every push to master, release-please maintains a "Release PR" that bumps
+# the project version (from Conventional Commits) and updates CHANGELOG.md.
+# Merging that Release PR creates the GitHub release + the project version tag
+# (vX.Y.Z); the build/push jobs below are gated on that release and publish the
+# images. No separate release.yml and no Personal Access Token are needed — the
+# build is wired in-workflow on the `release_created` output, so the default
+# GITHUB_TOKEN (plus the existing DockerHub secrets) is enough.
+
+on:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    runs-on: ubuntu-22.04
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
+    steps:
+      - id: release
+        uses: googleapis/release-please-action@v4
+        with:
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  load_supported_versions:
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-22.04
+    outputs:
+      matrix: ${{ steps.set-matrix.outputs.matrix }}
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Save supported versions as output
+        id: set-matrix
+        run: |
+          VERSIONS=$(cat ./supported_versions.json | jq -c)
+          echo "matrix=${VERSIONS}" >> $GITHUB_OUTPUT
+
+  build_push_release:
+    needs: [release-please, load_supported_versions]
+    runs-on: ubuntu-22.04
+
+    strategy:
+      matrix: ${{ fromJSON(needs.load_supported_versions.outputs.matrix) }}
+
+    env:
+      ORGANIZATION: "zenika"
+      IMAGE_NAME: "terraform-aws-cli"
+      RELEASE_VERSION: ${{ needs.release-please.outputs.tag_name }}
+
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v3
+
+      - name: Determine if this is the latest version combination
+        run: |
+          LATEST_TF=$(jq -r '.tf_versions | sort | .[-1]' supported_versions.json)
+          LATEST_AWS=$(jq -r '.awscli_versions | sort | .[-1]' supported_versions.json)
+          if [ "${{ matrix.tf_versions }}" = "${LATEST_TF}" ] && [ "${{ matrix.awscli_versions }}" = "${LATEST_AWS}" ]; then
+            echo "IS_LATEST=true" >> $GITHUB_ENV
+          else
+            echo "IS_LATEST=false" >> $GITHUB_ENV
+          fi
+
+      - name: Login to Docker Hub registry
+        run: echo '${{ secrets.DOCKERHUB_PAT }}' | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Build and push image (pinned combination)
+        if: env.IS_LATEST != 'true'
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386
+          build-args: |
+            TERRAFORM_VERSION=${{ matrix.tf_versions }}
+            AWS_CLI_VERSION=${{ matrix.awscli_versions }}
+          tags: ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}_tf-${{ matrix.tf_versions }}_aws-${{ matrix.awscli_versions }}
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Build and push image (latest combination)
+        if: env.IS_LATEST == 'true'
+        uses: docker/build-push-action@v4
+        with:
+          context: .
+          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386
+          build-args: |
+            TERRAFORM_VERSION=${{ matrix.tf_versions }}
+            AWS_CLI_VERSION=${{ matrix.awscli_versions }}
+          tags: |
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}_tf-${{ matrix.tf_versions }}_aws-${{ matrix.awscli_versions }}
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}
+            ${{ env.ORGANIZATION }}/${{ env.IMAGE_NAME }}:latest
+          push: true
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 494c841..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,63 +0,0 @@
-name: release
-
-# trigger on published release
-on:
-  release:
-    types: [published]
-
-jobs:
-  load_supported_versions:
-    runs-on: ubuntu-22.04
-
-    outputs:
-      matrix: ${{ steps.set-matrix.outputs.matrix }}
-
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v3
-
-      - name: Save supported versions as output
-        id: set-matrix
-        run: |
-          VERSIONS=$(cat ./supported_versions.json | jq -c)
-          echo "matrix=${VERSIONS}" >> $GITHUB_OUTPUT
-
-  build_push_release:
-    runs-on: ubuntu-22.04
-    needs: load_supported_versions
-
-    strategy:
-      matrix: ${{ fromJSON(needs.load_supported_versions.outputs.matrix) }}
-
-    env:
-      ORGANIZATION: "zenika"
-      IMAGE_NAME: "terraform-aws-cli"
-
-    steps:
-      - name: Check out the repo
-        uses: actions/checkout@v3
-
-      - name: Get and save the release tag
-        run: echo "RELEASE_TAG=${GITHUB_REF##*/}" >> $GITHUB_ENV
-
-      - name: Login to Docker Hub registry
-        run: echo '${{ secrets.DOCKERHUB_PAT }}' | docker login -u ${{ secrets.DOCKERHUB_USERNAME }} --password-stdin
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-
-      - name: Set up Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Build and push container images
-        uses: docker/build-push-action@v4
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64,linux/arm/v7,linux/386
-          build-args: |
-            TERRAFORM_VERSION=${{ matrix.tf_versions }}
-            AWS_CLI_VERSION=${{ matrix.awscli_versions }}
-          tags: zenika/terraform-aws-cli:release-${{ env.RELEASE_TAG }}_terraform-${{ matrix.tf_versions }}_awscli-${{ matrix.awscli_versions }}
-          push: true
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
new file mode 100644
index 0000000..32ac658
--- /dev/null
+++ b/.release-please-manifest.json
@@ -0,0 +1,3 @@
+{
+  ".": "8.0.0"
+}
diff --git a/README.md b/README.md
index 68d7af0..0795670 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 [![lint-dockerfile](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/lint-dockerfile.yml/badge.svg)](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/lint-dockerfile.yml)
 [![build-test](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/build-test.yml/badge.svg)](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/build-test.yml)
 [![push-latest](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/push-latest.yml/badge.svg)](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/push-latest.yml)
-[![release](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/release.yml/badge.svg)](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/release.yml)
+[![release-please](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/release-please.yml/badge.svg)](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/release-please.yml)
 
 [![dockerhub-description-update](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/dockerhub-description-update.yml/badge.svg)](https://github.com/zenika-open-source/terraform-aws-cli/actions/workflows/dockerhub-description-update.yml)
 [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
diff --git a/docs/adr/0002-contribution-and-release-workflow.md b/docs/adr/0002-contribution-and-release-workflow.md
index e047960..ac1d5ac 100644
--- a/docs/adr/0002-contribution-and-release-workflow.md
+++ b/docs/adr/0002-contribution-and-release-workflow.md
@@ -33,8 +33,11 @@ Adopted as one interlocking workflow:
   subject and feeds the changelog. Squash default message = *Pull request title
   and description* (carries `BREAKING CHANGE:` footers for release-please).
 - **release-please** drives versioning, changelog and GitHub releases via a
-  Release PR; `release.yml` triggers on Release-PR merge. The manual release
-  flow is removed.
+  Release PR. Merging that Release PR is the release trigger; the image
+  build/push runs in the **same `release-please.yml` workflow**, gated on the
+  `release_created` output (no separate `release.yml`, no Personal Access
+  Token — the default `GITHUB_TOKEN` suffices). The manual release flow is
+  removed.
 - Optional opt-in local `.githooks/commit-msg` running commitlint in Docker.
 - **Renovate only**; `.github/dependabot.yml` is retired.
 
@@ -56,3 +59,10 @@ Tag strategy is decided separately in ADR-0003.
 
 > **Amended 2026-06-15/16** — recorded the squash default commit message
 > (*Pull request title and description*). Clarification, not a reversal.
+>
+> **Amended 2026-06-17** — the build/push runs inside the single
+> `release-please.yml` workflow gated on `release_created`, rather than a
+> separate tag-triggered `release.yml`. This avoids a Personal Access Token
+> (tags pushed by `GITHUB_TOKEN` do not trigger other workflows) and fits the
+> low-friction driver. Mechanism clarification; the decision (release-please,
+> Release-PR trigger) is unchanged.
diff --git a/docs/roadmap.md b/docs/roadmap.md
index fcf873a..cf1fdb3 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -155,7 +155,7 @@ The contribution + release machinery. May split into 1a (governance docs) and
 - `CONTRIBUTING.md`, `SECURITY.md`, `CODEOWNERS` *(#105)*
 - `.github/PULL_REQUEST_TEMPLATE.md` (ADR checkbox) + `.github/ISSUE_TEMPLATE/` (`bug.yml`, `bump-version.yml`, `feature.yml`) *(#105)*
 - `.commitlintrc.json` + `.github/workflows/commitlint.yml` validating each PR commit **and** the PR title; **strict** failure mode *(#101)*
-- **release-please** config + workflow; migrate `release.yml` to trigger on Release-PR merge; remove the manual release flow *(#101)*
+- **release-please** config + a single `release-please.yml` workflow (versioning/changelog/GitHub release, with the image build/push gated on the Release-PR merge via the `release_created` output); remove the manual release flow *(#101)*
 - Branch protection applied via the GitHub UI (squash-merge, required review)
 - Tag strategy applied — P0 subset (`latest`, `vX.Y.Z`, fully-pinned)
 - **Retire `.github/dependabot.yml`; extend `renovate.json`** (grouping, automerge patches, `chore(deps):` prefix, custom manager for `supported_versions.json`) *(#102, relates #20)*
diff --git a/release-please-config.json b/release-please-config.json
new file mode 100644
index 0000000..f09c98d
--- /dev/null
+++ b/release-please-config.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "bootstrap-sha": "d99846edd4221248f023fc07945d8eb0e342bf01",
+  "packages": {
+    ".": {
+      "release-type": "simple",
+      "package-name": "terraform-aws-cli",
+      "changelog-path": "CHANGELOG.md",
+      "include-v-in-tag": true,
+      "include-component-in-tag": false,
+      "bump-minor-pre-major": false,
+      "draft": false,
+      "prerelease": false
+    }
+  }
+}