diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 13d39df..2986b33 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -9,12 +9,6 @@ on:
 permissions:
   contents: write # For creating releases.
 
-# Cancel in-progress runs for pull requests when developers push
-# additional changes
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
-
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
new file mode 100644
index 0000000..30e4b8f
--- /dev/null
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,31 @@
+name: publish
+
+on:
+  release:
+    types:
+      - released
+  workflow_dispatch:
+
+permissions:
+  packages: write # For pushing to ghcr.io.
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: robinraju/release-downloader@v1.5
+        with:
+          repository: "coder/code-marketplace"
+          tag: ${{ github.ref_name }}
+          fileName: "code-marketplace-linux-*"
+          out-file-path: "bin"
+
+      - uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-qemu-action@v2
+      - uses: docker/setup-buildx-action@v2
+      - run: docker buildx bake -f ./docker-bake.hcl --push
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..6cb8fba
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,10 @@
+# syntax=docker/dockerfile:experimental
+
+FROM scratch AS binaries
+ARG TARGETARCH
+COPY ./bin/code-marketplace-linux-$TARGETARCH /opt/code-marketplace
+
+FROM alpine:latest
+COPY --from=binaries /opt/code-marketplace /opt
+
+ENTRYPOINT [ "/opt/code-marketplace", "server" ]
diff --git a/Makefile b/Makefile
index b7cb768..e1d7dd1 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,3 @@
-#TODO: build
-
 lint: lint/go
 .PHONY: lint
 
@@ -22,10 +20,10 @@ coverage:
 TAG=$(shell git describe --always)
 
 build:
-	GOOS=darwin GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-mac-amd64 ./cmd/marketplace/main.go
-	GOOS=darwin GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-mac-arm64 ./cmd/marketplace/main.go
-	GOOS=linux GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-amd64 ./cmd/marketplace/main.go
-	GOOS=linux GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-arm64 ./cmd/marketplace/main.go
-	GOOS=windows GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-amd64 ./cmd/marketplace/main.go
-	GOOS=windows GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-arm64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-mac-amd64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-mac-arm64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-amd64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-linux-arm64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-amd64 ./cmd/marketplace/main.go
+	CGO_ENABLED=0 GOOS=windows GOARCH=arm64 go build -ldflags "-X github.com/coder/code-marketplace/buildinfo.tag=$(TAG)" -o bin/code-marketplace-windows-arm64 ./cmd/marketplace/main.go
 .PHONY: build
diff --git a/docker-bake.hcl b/docker-bake.hcl
new file mode 100644
index 0000000..f21a998
--- /dev/null
+++ b/docker-bake.hcl
@@ -0,0 +1,13 @@
+variable "GITHUB_REF_NAME" {}
+
+group "default" {
+  targets = ["code-marketplace"]
+}
+
+target "code-marketplace" {
+  dockerfile = "./Dockerfile"
+  tags = [
+    "ghcr.io/coder/code-marketplace:${GITHUB_REF_NAME}",
+  ]
+  platforms = ["linux/amd64", "linux/arm64"]
+}