diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cd41935f..7a0c5a03 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -130,6 +130,43 @@ jobs:
         name: modctl-${{ matrix.goos }}-${{ matrix.goarch }}
         path: dist/
 
+  publish-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1    # v4.3.1
+
+    - name: Extract short commit
+      id: vars
+      run: echo "commit=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c    # v4.2.0
+
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f    # v4.6.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build and push image
+      uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a    # v7.3.0
+      with:
+        context: .
+        file: ./build/Dockerfile
+        push: true
+        platforms: linux/amd64,linux/arm64
+        build-args: |
+          GITVERSION=${{ github.ref_name }}
+          GITCOMMIT=${{ steps.vars.outputs.commit }}
+        tags: |
+          ghcr.io/${{ github.repository }}:${{ github.ref_name }}
+          ghcr.io/${{ github.repository }}:latest
+
   create-release:
     needs: release
     runs-on: ubuntu-latest
diff --git a/build/Dockerfile b/build/Dockerfile
new file mode 100644
index 00000000..b49f1168
--- /dev/null
+++ b/build/Dockerfile
@@ -0,0 +1,19 @@
+# syntax=docker/dockerfile:1
+
+FROM --platform=$BUILDPLATFORM golang:1.25 AS builder
+ARG TARGETOS
+ARG TARGETARCH
+ARG GITVERSION=unknown
+ARG GITCOMMIT=unknown
+WORKDIR /app
+COPY . .
+RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build \
+      -ldflags "-w -X github.com/modelpack/modctl/pkg/version.GitVersion=${GITVERSION} \
+                   -X github.com/modelpack/modctl/pkg/version.GitCommit=${GITCOMMIT} \
+                   -X github.com/modelpack/modctl/pkg/version.BuildTime=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
+      -o modctl \
+      main.go
+
+FROM gcr.io/distroless/static-debian13:nonroot
+COPY --from=builder /app/modctl /usr/local/bin/modctl
+ENTRYPOINT ["/usr/local/bin/modctl"]