diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e7da6db..5ed266d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -30,16 +30,21 @@ jobs:
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
-      -
-        name: "Login to Quay.io"
+      - name: "Login to Quay.io"
         if: steps.tagging.outputs.part
         uses: docker/login-action@v2
         with:
           registry: quay.io
           username: ${{ secrets.QUAY_BOT_USERNAME }}
           password: ${{ secrets.QUAY_BOT_PASSWORD }}
-      -
-        name: "Build and push"
+      - name: "Login to ghcr.io"
+        if: steps.tagging.outputs.part
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: "Build and push"
         if: steps.tagging.outputs.part
         id: docker_build
         uses: docker/build-push-action@v4
@@ -51,6 +56,8 @@ jobs:
             docker.io/kiwigrid/k8s-sidecar:${{ steps.tagging.outputs.tag }}
             quay.io/kiwigrid/k8s-sidecar:latest
             quay.io/kiwigrid/k8s-sidecar:${{ steps.tagging.outputs.tag }}
+            ghcr.io/kiwigrid/k8s-sidecar:latest
+            ghcr.io/kiwigrid/k8s-sidecar:${{ steps.tagging.outputs.tag }}
       - name: "Build Changelog"
         if: steps.tagging.outputs.part
         id: build_changelog
@@ -69,4 +76,4 @@ jobs:
           release_name: v${{ steps.tagging.outputs.tag }}
           body: ${{ steps.build_changelog.outputs.changelog }}
           draft: false
-          prerelease: false
\ No newline at end of file
+          prerelease: false
diff --git a/Dockerfile b/Dockerfile
index 4fa492e..bbf910b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -11,6 +11,9 @@ RUN apk add --no-cache gcc && \
 
 
 FROM base
+LABEL org.opencontainers.image.source=https://github.com/kiwigrid/k8s-sidecar
+LABEL org.opencontainers.image.description="K8s sidecar image to collect configmaps and secrets as files"
+LABEL org.opencontainers.image.licenses=MIT
 ENV         PYTHONUNBUFFERED=1
 WORKDIR /app
 COPY --from=builder /app /app
diff --git a/README.md b/README.md
index 7835751..23c3650 100644
--- a/README.md
+++ b/README.md
@@ -23,6 +23,7 @@ Images are available at:
 
 - [docker.io/kiwigrid/k8s-sidecar](https://hub.docker.com/r/kiwigrid/k8s-sidecar)
 - [quay.io/kiwigrid/k8s-sidecar](https://quay.io/repository/kiwigrid/k8s-sidecar)
+- [ghcr.io/kiwigrid/k8s-sidecar](https://github.com/orgs/kiwigrid/packages/container/package/k8s-sidecar)
 
 Both are identical multi-arch images built for `amd64`, `arm64`, `arm/v7`, `ppc64le` and `s390x`
 
@@ -76,7 +77,7 @@ If the filename ends with `.url` suffix, the content will be processed as a URL
 | `REQ_TIMEOUT`              | How many seconds to wait for the server to send data before giving up for `.url` triggered requests or requests to `REQ_URI` (does not apply to k8s api requests)                                                                                                                                                                   | false    | `10`                                      | float   |
 | `REQ_USERNAME`             | Username to use for basic authentication for requests to `REQ_URL` and for `*.url` triggered requests                                                                                                                                                                                                                               | false    | -                                         | string  |
 | `REQ_PASSWORD`             | Password to use for basic authentication for requests to `REQ_URL` and for `*.url` triggered requests                                                                                                                                                                                                                               | false    | -                                         | string  |
-| `REQ_BASIC_AUTH_ENCODING`  | Which encoding to use for username and password as [by default it's undefined](https://datatracker.ietf.org/doc/html/rfc7617) (e.g. `utf-8`).                                                                                                                                                                                       | false    | `latin1`                                   | string  |
+| `REQ_BASIC_AUTH_ENCODING`  | Which encoding to use for username and password as [by default it's undefined](https://datatracker.ietf.org/doc/html/rfc7617) (e.g. `utf-8`).                                                                                                                                                                                       | false    | `latin1`                                  | string  |
 | `SCRIPT`                   | Absolute path to shell script to execute after a configmap got reloaded. It runs before calls to `REQ_URI`                                                                                                                                                                                                                          | false    | -                                         | string  |
 | `ERROR_THROTTLE_SLEEP`     | How many seconds to wait before watching resources again when an error occurs                                                                                                                                                                                                                                                       | false    | `5`                                       | integer |
 | `SKIP_TLS_VERIFY`          | Set to `true` to skip tls verification for kube api calls                                                                                                                                                                                                                                                                           | false    | -                                         | boolean |