diff --git a/.github/workflows/build-base-image.yml b/.github/workflows/build-base-image.yml
new file mode 100644
index 0000000..431ea6f
--- /dev/null
+++ b/.github/workflows/build-base-image.yml
@@ -0,0 +1,34 @@
+name: Build and Push Base Image
+
+on:
+  push:
+    branches: [main]
+    paths: [Dockerfile.base]
+  workflow_dispatch:
+
+env:
+  IMAGE_NAME: ghcr.io/shopify/lighthouse-ci-action
+  IMAGE_TAG: "3.0.0"
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build base image
+        run: docker build -t ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} -f Dockerfile.base .
+
+      - name: Push base image
+        run: docker push ${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
diff --git a/Dockerfile.base b/Dockerfile.base
index 0af7c4a..a9deac1 100644
--- a/Dockerfile.base
+++ b/Dockerfile.base
@@ -1,4 +1,4 @@
-FROM node:18-buster
+FROM node:20-bookworm
 
 ENV PATH="/root/.rbenv/shims:${PATH}"
 
@@ -11,10 +11,10 @@ RUN apt-get update \
     && rbenv install 3.2.0 \
     && rbenv global 3.2.0
 
-# Install latest chrome stable package.
-RUN wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add -
-RUN sh -c 'echo "deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main" >> /etc/apt/sources.list.d/google.list'
-RUN apt-get update \
+# Install latest chrome stable package (using signed-by for Bookworm compatibility).
+RUN wget -q -O /usr/share/keyrings/google-chrome.gpg https://dl-ssl.google.com/linux/linux_signing_key.pub \
+    && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list \
+    && apt-get update \
     && apt-get install -y google-chrome-stable --no-install-recommends \
     && apt-get clean