diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..4b5204db
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,31 @@
+name: release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'release-*'
+    tags:
+      - 'v*'
+
+jobs:
+  publish-docker-image-to-ghcr:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Import environment variables from file
+        run: cat ".github/env" >> $GITHUB_ENV
+      - name: Install Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: '${{ env.golang-version }}'
+      - name: Login to ghcr.io
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build and push Docker images
+        run: make release
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
index 3e57913a..f2ba5d57 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,9 +9,10 @@
 docker/
 
 # build artifacts
-cluster-registry
+cluster-registry*
 kubeconfig
 .dynamodb
+.hack*
 
 # Binaries for programs and plugins
 bin
diff --git a/Makefile b/Makefile
index c92224de..690bbd4a 100644
--- a/Makefile
+++ b/Makefile
@@ -46,7 +46,37 @@ clean:
 ############
 
 .PHONY: build
-build: # TODO
+build: build-api build-cc
+
+.PHONY: build-api
+build-api:
+	$(GO_BUILD_RECIPE) -o cluster-registry-api cmd/api/api.go
+
+.PHONY: build-cc
+build-cc:
+	$(GO_BUILD_RECIPE) -o cluster-registry-client cmd/cc/client.go
+
+.PHONY: release
+release:
+	./hack/release.sh
+
+.PHONY: image
+image: .hack-api-image .hack-cc-image
+
+.hack-api-image: cmd/api/Dockerfile build-api
+	docker build -t $(IMAGE_API):$(TAG) -f cmd/api/Dockerfile .
+	touch $@
+
+.hack-cc-image: cmd/cc/Dockerfile build-cc
+	docker build -t $(IMAGE_CC):$(TAG) -f cmd/cc/Dockerfile .
+	touch $@
+
+.PHONY: update-go-deps
+update-go-deps:
+	for m in $$(go list -mod=readonly -m -f '{{ if and (not .Indirect) (not .Main)}}{{.Path}}{{end}}' all); do \
+		go get $$m; \
+	done
+	@echo "Don't forget to run 'make tidy'"
 
 
 ##############
diff --git a/cmd/api/Dockerfile b/cmd/api/Dockerfile
new file mode 100644
index 00000000..7c1d4320
--- /dev/null
+++ b/cmd/api/Dockerfile
@@ -0,0 +1,6 @@
+FROM alpine
+RUN apk add --update --no-cache ca-certificates
+ADD cluster-registry-api /bin/api
+USER nobody
+EXPOSE 8080
+ENTRYPOINT ["/bin/api"]
diff --git a/cmd/cc/Dockerfile b/cmd/cc/Dockerfile
new file mode 100644
index 00000000..431304c8
--- /dev/null
+++ b/cmd/cc/Dockerfile
@@ -0,0 +1,5 @@
+FROM alpine
+RUN apk add --update --no-cache ca-certificates
+ADD cluster-registry-client /bin/client
+USER nobody
+ENTRYPOINT ["/bin/client"]
diff --git a/hack/release.sh b/hack/release.sh
new file mode 100755
index 00000000..c41ef5ed
--- /dev/null
+++ b/hack/release.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# exit immediately when a command fails
+set -e
+# only exit with zero if all commands of the pipeline exit successfully
+set -o pipefail
+
+REGISTRY="ghcr.io"
+
+export IMAGE_API="${IMAGE_API:-"adobe/cluster-registry-api"}"
+export IMAGE_CC="${IMAGE_CC:-"adobe/cluster-registry-client"}"
+export TAG="${GITHUB_REF##*/}"
+
+IMAGE_SUFFIX="-dev"
+
+if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+ ]] || [ "${TAG}" == "main" ]; then
+	IMAGE_SUFFIX=""
+else
+	TAG="v$(cat "$(git rev-parse --show-toplevel)/VERSION")-$(git rev-parse --short HEAD)"
+fi
+
+API="${REGISTRY}/${IMAGE_API}${IMAGE_SUFFIX}"
+CC="${REGISTRY}/${IMAGE_CC}${IMAGE_SUFFIX}"
+
+for img in ${API} ${CC}; do
+	echo "Building image: $img:$TAG"
+done
+
+make --always-make image TAG="${TAG}"
+
+docker tag "${IMAGE_API}:${TAG}" "${API}:${TAG}"
+docker tag "${IMAGE_CC}:${TAG}" "${CC}:${TAG}"
+
+docker push "${API}:${TAG}"
+docker push "${CC}:${TAG}"
\ No newline at end of file