diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
new file mode 100644
index 00000000..32d8f2d0
--- /dev/null
+++ b/.github/workflows/build-image.yml
@@ -0,0 +1,57 @@
+---
+name: Build container image
+
+on:
+  workflow_dispatch:
+  push:
+    branches: [ main ]
+    tags: [ '*' ]
+  pull_request:
+    paths:
+      - .github/workflows/build-image.yml
+      - Containerfile
+
+jobs:
+  build-image:
+    runs-on: ubuntu-latest
+
+    concurrency:
+      group: ${{ github.ref }}
+      cancel-in-progress: true
+
+    steps:
+      - uses: actions/checkout@v3.3.0
+
+      - name: Discover build-time variables
+        run: |
+          echo "RUBY_VERSION=$(cat .ruby-version)" >> $GITHUB_ENV
+          echo "BUNDLER_VERSION=$(egrep -A1 "^BUNDLED WITH" Gemfile.lock | tr -d '\n' | awk '{ print $3; }')" >> $GITHUB_ENV
+          case "${{ github.ref_name }}" in
+          */merge)
+            # use commit id as version for pull requests
+            echo "RETROSPRING_VERSION=${{ github.sha }}" >> $GITHUB_ENV
+            ;;
+          *)
+            # use tags and branches as version otherwise
+            echo "RETROSPRING_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
+            ;;
+          esac
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v2
+        with:
+          username: ${{ vars.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+        if: github.event_name != 'pull_request'
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          build-args: |
+            BUNDLER_VERSION=${{ env.BUNDLER_VERSION }}
+            RETROSPRING_VERSION=${{ env.RETROSPRING_VERSION }}
+            RUBY_VERSION=${{ env.RUBY_VERSION }}
+          context: .
+          file: Containerfile
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: retrospring/retrospring:${{ env.RETROSPRING_VERSION }}
diff --git a/Containerfile b/Containerfile
index 637aebee..2e740498 100644
--- a/Containerfile
+++ b/Containerfile
@@ -57,7 +57,7 @@ WORKDIR /opt/retrospring/app
 USER justask:users
 
 # install the app
-RUN curl -L https://github.com/Retrospring/retrospring/archive/refs/tags/${RETROSPRING_VERSION}.tar.gz | tar xz --strip-components=1
+RUN curl -L https://github.com/Retrospring/retrospring/archive/${RETROSPRING_VERSION}.tar.gz | tar xz --strip-components=1
 
 RUN bundle config set without 'development test'     \
  && bundle config set path '/opt/retrospring/bundle' \