diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9177080d..cfa8785f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,13 @@ on:
       # failure mode the packages/** comment above describes, just for a
       # different path. This was live for every commit between #432 and now.
       - 'services/chat-service/**'
+      # notification-service/** and payment-service/** were both missing here,
+      # the same silent-ship gap the chat-service comment above describes: a
+      # change confined to one of those service dirs would merge green and never
+      # trigger a release, so the image would keep the old code (or, for the
+      # never-built payment-service, stay absent entirely).
+      - 'services/notification-service/**'
+      - 'services/payment-service/**'
       - 'clock-app/**'
       - 'deploy/helm/fuzefront/**'
       - '.github/workflows/release.yml'
@@ -164,6 +171,25 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Build & push payment-service
+        # Self-contained Dockerfile (no @fuzefront/shared dep) => context is
+        # services/payment-service/, like clock-app — NOT the repo root the
+        # workspace services use. Scaffold gateway, disabled in prod; this build
+        # only makes the image EXIST so paymentService.image.tag can be bumped
+        # off "" and a future go-live is a values flip, not a missing image.
+        id: payment_image
+        continue-on-error: true
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: services/payment-service
+          file: services/payment-service/Dockerfile
+          push: true
+          tags: |
+            ghcr.io/izzywdev/fuzefront-payment-service:${{ steps.tag.outputs.sha }}
+            ghcr.io/izzywdev/fuzefront-payment-service:latest
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
       - name: Build & push security-service
         id: security_image
         continue-on-error: true
@@ -303,8 +329,9 @@ jobs:
           CLOCK_OK=$(ok "${{ steps.clock_image.outcome }}")
           CHAT_OK=$(ok "${{ steps.chat_image.outcome }}")
           NOTIF_OK=$(ok "${{ steps.notification_image.outcome }}")
-          EXPECTED=$((2 + EMAIL_OK + SMS_OK + PROV_OK + BILLING_OK + SECURITY_OK + APPS_OK + CLOCK_OK + CHAT_OK + NOTIF_OK))
-          echo "built: email=${EMAIL_OK} sms=${SMS_OK} provisioning=${PROV_OK} billing=${BILLING_OK} security=${SECURITY_OK} applications=${APPS_OK} clock=${CLOCK_OK} chat=${CHAT_OK} notification=${NOTIF_OK}"
+          PAYMENT_OK=$(ok "${{ steps.payment_image.outcome }}")
+          EXPECTED=$((2 + EMAIL_OK + SMS_OK + PROV_OK + BILLING_OK + SECURITY_OK + APPS_OK + CLOCK_OK + CHAT_OK + NOTIF_OK + PAYMENT_OK))
+          echo "built: email=${EMAIL_OK} sms=${SMS_OK} provisioning=${PROV_OK} billing=${BILLING_OK} security=${SECURITY_OK} applications=${APPS_OK} clock=${CLOCK_OK} chat=${CHAT_OK} notification=${NOTIF_OK} payment=${PAYMENT_OK}"
           echo "expecting ${EXPECTED} tag rewrites (backend + frontend are always built)"
           if [ "${APPS_OK}${SECURITY_OK}${EMAIL_OK}${BILLING_OK}" != "1111" ]; then
             echo "::warning::one or more auxiliary images failed to build; their values-prod tags are left pinned to the last good release"
@@ -341,7 +368,7 @@ jobs:
           awk -v sha="$SHA" -v chat="$CHAT_OK" -v notif="$NOTIF_OK" \
               -v email="$EMAIL_OK" -v sms="$SMS_OK" -v prov="$PROV_OK" \
               -v billing="$BILLING_OK" -v security="$SECURITY_OK" \
-              -v apps="$APPS_OK" -v clock="$CLOCK_OK" '
+              -v apps="$APPS_OK" -v clock="$CLOCK_OK" -v payment="$PAYMENT_OK" '
             hot {
               hot=0
               if ($0 ~ /^[[:space:]]*tag:/) {
@@ -362,6 +389,7 @@ jobs:
             prov == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-provisioning-service\r?$/ { hot=1 }
             chat == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-chat-service\r?$/ { hot=1 }
             notif == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-notification-service\r?$/ { hot=1 }
+            payment == 1 && /repository: ghcr\.io\/izzywdev\/fuzefront-payment-service\r?$/ { hot=1 }
             { print }
             END { print n+0 > "/tmp/bump-count" }
           ' /tmp/vp-current.yaml > /tmp/vp-new.yaml