diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index db3b2ef..502aa26 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -92,6 +92,21 @@ jobs:
           git tag -s -m "Release ${TAG}" "${TAG}"
           git push origin "${TAG}"
 
+      - name: Create release branch
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+        run: |
+          BRANCH="release-${VERSION%.*}"
+          if gh api "repos/${GITHUB_REPOSITORY}/branches/${BRANCH}" >/dev/null 2>&1; then
+            echo "Branch ${BRANCH} already exists, skipping"
+          else
+            SHA=$(git rev-parse HEAD)
+            gh api "repos/${GITHUB_REPOSITORY}/git/refs" \
+              -f "ref=refs/heads/${BRANCH}" \
+              -f "sha=${SHA}"
+          fi
+
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
@@ -113,6 +128,20 @@ jobs:
           TAG: ${{ steps.version.outputs.tag }}
         run: make release-manifest IMG="${IMAGE}:${TAG}"
 
+      - name: Package and push Helm chart
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+          TAG: ${{ steps.version.outputs.tag }}
+          ACTOR: ${{ github.actor }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          make helm
+          ./bin/yq -i ".version = \"${VERSION}\"" chart/bootc-operator/Chart.yaml
+          ./bin/yq -i ".appVersion = \"${TAG}\"" chart/bootc-operator/Chart.yaml
+          helm package chart/bootc-operator
+          helm registry login -u "${ACTOR}" -p "${GH_TOKEN}" ghcr.io
+          helm push "bootc-operator-${VERSION}.tgz" oci://ghcr.io/${{ github.repository }}/charts
+
       - name: Create release
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
@@ -120,9 +149,16 @@ jobs:
         run: |
           {
             printf '## Installation\n\n'
+            printf '### kubectl\n\n'
             printf '```bash\n'
             printf 'kubectl apply -f https://github.com/%s/releases/download/%s/install.yaml\n' \
               "${GITHUB_REPOSITORY}" "${TAG}"
+            printf '```\n\n'
+            printf '### Helm\n\n'
+            printf '```bash\n'
+            printf 'helm install bootc-operator oci://ghcr.io/%s/charts/bootc-operator --version %s \\\n' \
+              "${GITHUB_REPOSITORY}" "${TAG#v}"
+            printf '  --create-namespace --namespace bootc-operator\n'
             printf '```\n'
           } > notes.md
           gh release create "${TAG}" \
diff --git a/VERSION b/VERSION
index 6e8bf73..0ea3a94 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.1.0
+0.2.0
diff --git a/docs/src/helm.md b/docs/src/helm.md
index 22ed264..ebb67c0 100644
--- a/docs/src/helm.md
+++ b/docs/src/helm.md
@@ -7,6 +7,23 @@
 
 ## Install
 
+Install from the OCI registry:
+
+```bash
+helm install bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \
+  --create-namespace --namespace bootc-operator
+```
+
+To install a specific version:
+
+```bash
+helm install bootc-operator oci://ghcr.io/bootc-dev/bootc-operator/charts/bootc-operator \
+  --version 0.1.0 \
+  --create-namespace --namespace bootc-operator
+```
+
+Alternatively, install from a local checkout:
+
 ```bash
 helm install bootc-operator ./chart/bootc-operator \
   --create-namespace --namespace bootc-operator
diff --git a/hack/sync-helm.sh b/hack/sync-helm.sh
index 54f6daf..fd67a75 100755
--- a/hack/sync-helm.sh
+++ b/hack/sync-helm.sh
@@ -56,7 +56,8 @@ gen_workload() {
         .metadata.namespace = \"HELM_NAMESPACE\" |
         .spec.template.spec.serviceAccountName = \"HELM_FULLNAME-${name}\" |
         .spec.template.spec.containers[0].image = \"HELM_IMAGE\" |
-        del(.metadata.labels.\"app.kubernetes.io/managed-by\") |
+        del(.metadata.labels) |
+        .metadata.labels.HELM_LABELS_PLACEHOLDER = true |
         del(.spec.template.spec.containers[0].volumeMounts | select(length == 0)) |
         del(.spec.template.spec.volumes | select(length == 0)) |
         ... comments=\"\"
@@ -64,6 +65,7 @@ gen_workload() {
         -e 's/HELM_FULLNAME/{{ include "bootc-operator.fullname" . }}/g' \
         -e 's/HELM_NAMESPACE/{{ .Release.Namespace }}/g' \
         -e 's/HELM_IMAGE/{{ include "bootc-operator.image" . }}/g' \
+        -e '/HELM_LABELS_PLACEHOLDER/c\    {{- include "bootc-operator.labels" . | nindent 4 }}' \
     > "$output"
 
     sed -i '/image: {{ include "bootc-operator\.image" \. }}/a\
@@ -105,11 +107,14 @@ gen_binding() {
 
     "$YQ" -I2 "
         .metadata.name = \"HELM_FULLNAME-${name}\" |
-        del(.metadata.labels.\"app.kubernetes.io/managed-by\") |
+        del(.metadata.labels) |
+        .metadata.labels.HELM_LABELS_PLACEHOLDER = true |
         .roleRef.name = \"HELM_FULLNAME-${role_suffix}\" |
         .subjects[0].name = \"HELM_FULLNAME-${sa_suffix}\" |
         .subjects[0].namespace = \"HELM_NAMESPACE\"
-    " "$source" | helm_sed > "$output"
+    " "$source" | helm_sed | sed \
+        -e '/HELM_LABELS_PLACEHOLDER/c\    {{- include "bootc-operator.labels" . | nindent 4 }}' \
+    > "$output"
 }
 
 gen_binding "$CONFIG_DIR/rbac/role_binding.yaml" \
@@ -129,8 +134,11 @@ gen_sa() {
     "$YQ" -I2 "
         .metadata.name = \"HELM_FULLNAME-${name}\" |
         .metadata.namespace = \"HELM_NAMESPACE\" |
-        del(.metadata.labels.\"app.kubernetes.io/managed-by\")
-    " "$source" | helm_sed > "$output"
+        del(.metadata.labels) |
+        .metadata.labels.HELM_LABELS_PLACEHOLDER = true
+    " "$source" | helm_sed | sed \
+        -e '/HELM_LABELS_PLACEHOLDER/c\    {{- include "bootc-operator.labels" . | nindent 4 }}' \
+    > "$output"
 }
 
 gen_sa "$CONFIG_DIR/rbac/controller_service_account.yaml" \