diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 13ad919..a728f14 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,22 +1,63 @@
 name: Build and Deploy Decal Web
 
 on:
+  workflow_dispatch:
+  pull_request:
   push:
     branches:
-      - "main"
+      - main
 
 jobs:
-
   check-flake:
     runs-on: ci-ocf-decalweb
     steps:
       - uses: actions/checkout@v4
       - uses: DeterminateSystems/flake-checker-action@v9
 
-  build_and_deploy:
+  build-container:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+    env:
+      image_name: decalweb 
+      registry: ghcr.io/${{ github.repository_owner }}
+    steps:
+      - uses: actions/checkout@v7
 
-    runs-on: ci-ocf-decalweb
+      - uses: cachix/install-nix-action@v31
 
+      - name: Build and tag image
+        run: |
+          IMAGE_TAG=$(sh $(nix build .#image --no-link --print-out-paths) 2>/dev/null | podman load -q | grep -oe "$image_name:.*$" | sed -e "s/$image_name://")
+          echo "image_tags=$IMAGE_TAG" >> $GITHUB_ENV
+
+      - name: Tag latest
+        if: github.ref == 'refs/heads/main'
+        run: |
+          podman tag $image_name:$image_tags $image_name:latest
+          echo "image_tags=$image_tags latest" >> $GITHUB_ENV
+
+      - name: Log in to GHCR
+        uses: redhat-actions/podman-login@v1
+        with:
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+          registry: ${{ env.registry }}
+
+      - name: Push to GHCR
+        id: push-ghcr
+        uses: redhat-actions/push-to-registry@v2
+        with:
+          image: ${{ env.image_name }}
+          tags: ${{ env.image_tags }}
+          registry: ${{ env.registry }}
+
+      - name: Print image url
+        run: echo "Image pushed to ${{ steps.push-ghcr.outputs.registry-paths }}"
+
+  build_and_deploy:
+    runs-on: ci-ocf-decalweb
+    if: github.ref == 'refs/heads/main'
     steps:
       - name: Checkout
         uses: actions/checkout@v4
diff --git a/content/archives.md b/content/archives.md
index a7e1ed3..dc583ba 100644
--- a/content/archives.md
+++ b/content/archives.md
@@ -1,4 +1,5 @@
---- title: Archives
+---
+title: Archives
 weight: 50
 ---
 
diff --git a/default.nix b/default.nix
index 98e67d0..04e2393 100644
--- a/default.nix
+++ b/default.nix
@@ -1,4 +1,9 @@
-{ stdenvNoCC, git, hugo, just }:
+{
+  stdenvNoCC,
+  git,
+  hugo,
+  just,
+}:
 
 stdenvNoCC.mkDerivation {
   name = "ocf-decal-web";
@@ -9,10 +14,14 @@ stdenvNoCC.mkDerivation {
   ];
 
   buildPhase = ''
+    runHook preBuild
     hugo
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
     mv public $out
+    runHook postInstall
   '';
 }
diff --git a/flake.lock b/flake.lock
index d94195c..01c6721 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,16 +2,16 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1753939845,
-        "narHash": "sha256-K2ViRJfdVGE8tpJejs8Qpvvejks1+A4GQej/lBk5y7I=",
+        "lastModified": 1790920529,
+        "narHash": "sha256-nQyFkMR78WP6PiXKkDW2SjqzLf/spQqjRuxRGSbcV8k=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "94def634a20494ee057c76998843c015909d6311",
+        "rev": "774debe7a0d1b496e35677ad955a1011c6ff74f3",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
diff --git a/flake.nix b/flake.nix
index 8d4bb71..22a2bfe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,17 +1,80 @@
 {
   description = "Sysadmin DeCal website configuration for the Open Computing Facility";
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
     systems.url = "github:nix-systems/default";
   };
-  outputs = { self, nixpkgs, systems }:
+  outputs =
+    {
+      self,
+      nixpkgs,
+      systems,
+    }:
     let
-      pkgsFor = system: nixpkgs.legacyPackages.${system};
+      pkgsFor = system: import nixpkgs { inherit system; };
       forAllSystems = fn: nixpkgs.lib.genAttrs (import systems) (system: fn (pkgsFor system));
     in
     {
-      packages = forAllSystems (pkgs: {
+      packages = forAllSystems (pkgs: rec {
         default = pkgs.callPackage ./. { };
+        image = pkgs.dockerTools.streamLayeredImage (
+          let
+            timestamp = builtins.readFile (
+              pkgs.runCommand "timestamp" { } ''
+                date --date='@${toString self.lastModified}' --iso-8601=minutes > $out
+              ''
+            );
+
+            decalwebPath = default;
+
+            nginxPort = "80";
+            nginxConf = pkgs.writeText "nginx.conf" ''
+              user nobody nobody;
+              daemon off;
+              error_log /dev/stdout info;
+              pid /dev/null;
+              events {}
+              http {
+                include ${pkgs.nginx}/conf/mime.types;
+                default_type application/octet-stream;
+                access_log /dev/stdout;
+                server {
+                  listen ${nginxPort};
+                  root ${decalwebPath};
+                }
+              }
+            '';
+          in
+          {
+            name = "decalweb";
+            created = timestamp;
+            mtime = timestamp;
+
+            contents = with pkgs; [
+              busybox
+              nginx
+              dockerTools.fakeNss
+            ];
+
+            extraCommands = ''
+              # nginx requires these dirs to exist, see:
+              # https://github.com/NixOS/nixpkgs/blob/master/pkgs/build-support/docker/examples.nix
+              mkdir -p tmp/nginx_client_body
+              mkdir -p var/log/nginx
+            '';
+
+            config = {
+              Cmd = [
+                "nginx"
+                "-c"
+                nginxConf
+              ];
+              ExposedPorts = {
+                "${nginxPort}/tcp" = { };
+              };
+            };
+          }
+        );
       });
       devShells = forAllSystems (pkgs: {
         default = pkgs.mkShell {
@@ -19,12 +82,12 @@
           shellHook = "hugo server --minify";
         };
         deploy = pkgs.mkShell {
-	  packages = with pkgs; [
-	    rsync
-	    openssh
-	  ];
+          packages = with pkgs; [
+            rsync
+            openssh
+          ];
         };
       });
-      formatter = forAllSystems (pkgs: pkgs.nixpkgs-fmt);
+      formatter = forAllSystems (pkgs: pkgs.nixfmt-tree);
     };
 }