diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index 5081ab4..6d27e78 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -2,7 +2,8 @@ name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
+    tags: ["v*.*.*"]
   pull_request:
     types: [opened, reopened, synchronize]
 
@@ -15,19 +16,59 @@ jobs:
         platform: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.platform }}
     steps:
-    - uses: actions/checkout@v2
+      - uses: actions/checkout@v2
 
-    - name: setup go
-      uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7  # v5.0.1
-      with:
-        go-version: ${{ matrix.go-version }}
+      - name: setup go
+        uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+        with:
+          go-version: ${{ matrix.go-version }}
 
-    - name: Build
-      run: go build -v ./...
+      - name: Build
+        run: go build -v ./...
 
-    - name: Test
-      run: go test -v ./...
+      - name: Test
+        run: go test -v ./...
 
-    - name: Format
-      if: matrix.platform == 'ubuntu-latest'
-      run: if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then exit 1; fi
+      - name: Format
+        if: matrix.platform == 'ubuntu-latest'
+        run: if [ "$(gofmt -s -l . | wc -l)" -gt 0 ]; then exit 1; fi
+  docker-build-push:
+    if: github.event_name != 'pull_request'
+    needs: build-test
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+
+      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
+
+      - uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
+        id: meta
+        with:
+          images: |
+            ghcr.io/${{ github.repository }}
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=sha
+
+      - uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0
+        with:
+          context: .
+          push: true
+          file: Dockerfile.buildx
+          platforms: linux/amd64,linux/arm64,linux/arm
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile.buildx b/Dockerfile.buildx
new file mode 100644
index 0000000..c9dcfdd
--- /dev/null
+++ b/Dockerfile.buildx
@@ -0,0 +1,26 @@
+FROM --platform=$BUILDPLATFORM golang:1.21 AS builder
+
+WORKDIR /go/app
+
+COPY . .
+
+ARG TARGETOS TARGETARCH
+
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg \
+    CGO_ENABLED=0 make \
+        scepclient-$TARGETOS-$TARGETARCH \
+        scepserver-$TARGETOS-$TARGETARCH
+
+FROM alpine:3
+
+ARG TARGETOS TARGETARCH
+
+COPY --from=builder /go/app/scepclient-$TARGETOS-$TARGETARCH /usr/bin/scepclient
+COPY --from=builder /go/app/scepserver-$TARGETOS-$TARGETARCH /usr/bin/scepserver
+
+EXPOSE 8080
+
+VOLUME ["/depot"]
+
+ENTRYPOINT ["scepserver"]
diff --git a/Makefile b/Makefile
index 93c71de..5645638 100644
--- a/Makefile
+++ b/Makefile
@@ -4,6 +4,7 @@ OSARCH=$(shell go env GOHOSTOS)-$(shell go env GOHOSTARCH)
 
 SCEPCLIENT=\
 	scepclient-linux-amd64 \
+	scepclient-linux-arm64 \
 	scepclient-linux-arm \
 	scepclient-darwin-amd64 \
 	scepclient-darwin-arm64 \
@@ -12,6 +13,7 @@ SCEPCLIENT=\
 
 SCEPSERVER=\
 	scepserver-linux-amd64 \
+	scepserver-linux-arm64 \
 	scepserver-linux-arm \
 	scepserver-darwin-amd64 \
 	scepserver-darwin-arm64 \