diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6a6b666..9cdfe5e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -7,6 +7,7 @@ on:
       - "go.mod"
       - "go.sum"
       - ".goreleaser.yaml"
+      - "Dockerfile.goreleaser"
       - "VERSION"
 
 permissions:
@@ -65,7 +66,13 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - uses: goreleaser/goreleaser-action@v7
         with:
           version: latest
-          args: build --snapshot --clean
+          args: release --snapshot --clean --skip publish
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fc4ad23..60b5e3d 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -84,6 +84,18 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
       - uses: goreleaser/goreleaser-action@v7
         with:
           version: latest
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 28b54f6..195b7e1 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -43,6 +43,17 @@ changelog:
       - '^test:'
       - '^chore:'
 
+dockers_v2:
+  - images:
+      - "cataybe/tlsctl"
+    tags:
+      - "v{{ .Version }}"
+      - "latest"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    dockerfile: Dockerfile.goreleaser
+
 release:
   github:
     owner: catay
diff --git a/Dockerfile.goreleaser b/Dockerfile.goreleaser
new file mode 100644
index 0000000..afe8385
--- /dev/null
+++ b/Dockerfile.goreleaser
@@ -0,0 +1,11 @@
+FROM alpine:3.23
+
+ARG TARGETPLATFORM
+
+RUN set -eux; addgroup -g 6666 tlsctl && adduser -u 6666 -G tlsctl -D -H tlsctl
+
+COPY ${TARGETPLATFORM}/tlsctl /usr/bin/tlsctl
+
+USER tlsctl:tlsctl
+
+ENTRYPOINT ["/usr/bin/tlsctl"]
diff --git a/README.md b/README.md
index 9bd6c37..1689716 100644
--- a/README.md
+++ b/README.md
@@ -93,15 +93,24 @@ make build        # or: go build -o tlsctl .
 
 ### Docker
 
+Pre-built images are published to Docker Hub on every release:
+
 ```bash
-# Build the image
-docker build -t tlsctl .
+# Pull and run the latest release
+docker run --rm catay/tlsctl client github.com
 
-# Run
-docker run --rm tlsctl client github.com
+# Use a specific version
+docker run --rm catay/tlsctl:v1.1.0 client github.com
 
 # Inspect a local PEM file (mount it into the container)
-docker run --rm -v /path/to/cert.pem:/cert.pem:ro tlsctl pem /cert.pem
+docker run --rm -v /path/to/cert.pem:/cert.pem:ro catay/tlsctl pem /cert.pem
+```
+
+You can also build the image locally:
+
+```bash
+docker build -t tlsctl .
+docker run --rm tlsctl client github.com
 ```
 
 ## Quick start