diff --git a/.drone.yml b/.drone.yml
deleted file mode 100644
index 121d391..0000000
--- a/.drone.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-kind: pipeline
-name: build
-
-platform:
-  os: linux
-  arch: amd64
-
-steps:
-- name: build
-  pull: always
-  image: golang:1.14
-  commands:
-    - go build -v -ldflags '-w -extldflags '-static''
-  environment:
-    CGO_ENABLED: 0
-    GOPROXY: https://proxy.golang.org
-
-- name: container
-  image: plugins/docker
-  settings:
-    registry: quay.io
-    repo: quay.io/observatorium/namespace-provisioner
-    username:
-      from_secret: quay_username
-    password:
-      from_secret: quay_password
-  when:
-    branch:
-    - master
-    event:
-    - push
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..ecd9cf8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,58 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+    tags:
+      - "*"
+  pull_request:
+    branches: [ main ]
+  schedule:
+  - cron:  '0 0 * * *'
+  workflow_dispatch:
+
+jobs:
+
+  container:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Build container
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+
+  push:
+    if: github.event_name != 'pull_request'
+    needs:
+    - container
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v3
+      with:
+        registry: quay.io
+        username: ${{ secrets.QUAY_USERNAME }}
+        password: ${{ secrets.QUAY_PASSWORD }}
+    - name: Determine SHA
+      id: sha
+      run: echo "::set-output name=sha::$(git describe --always --tags --dirty)"
+    - name: Build and push
+      id: push
+      uses: docker/build-push-action@v5
+      with:
+        context: .
+        push: true
+        platforms: linux/arm64, linux/amd64
+        tags: quay.io/observatorium/namespace-provisioner:latest, quay.io/observatorium/namespace-provisioner:${{ steps.sha.outputs.sha }}
+    - name: Determine digest
+      run: echo ${{ steps.push.outputs.digest }}
diff --git a/Dockerfile b/Dockerfile
index c6fbde6..dfe42b0 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,23 @@
-FROM alpine:3.12
+FROM --platform=$BUILDPLATFORM golang:1.21-alpine3.19 AS build
 
-COPY ./namespace-provisioner /usr/bin/namespace-provisioner
+COPY . /src
+WORKDIR /src
+RUN go mod vendor
+ARG TARGETOS TARGETARCH
+RUN GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build .
+
+FROM scratch as runner
+COPY --from=build /src/namespace-provisioner /usr/bin/namespace-provisioner
+
+LABEL vendor="Observatorium" \
+    name="observatorium/namespace-provisioner" \
+    description="Create temporary namespaces in a Kubernetes cluster" \
+    io.k8s.display-name="observatorium/namespace-provisioner" \
+    io.k8s.description="Create temporary namespaces in a Kubernetes cluster" \
+    maintainer="Observatorium <team-monitoring@redhat.com>" \
+    org.label-schema.description="Create temporary namespaces in a Kubernetes cluster" \
+    org.label-schema.name="observatorium/namespace-provisioner" \
+    org.label-schema.schema-version="1.0" \
+    org.label-schema.vendor="Observatorium"
 
 ENTRYPOINT ["/usr/bin/namespace-provisioner"]