diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
new file mode 100644
index 0000000..ebfc3f7
--- /dev/null
+++ b/.github/workflows/docker-image.yml
@@ -0,0 +1,38 @@
+name: Docker Image CD
+
+on:
+  push:
+    branches: [ "master" ]
+  workflow_dispatch:
+
+jobs:
+
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      packages: write
+      contents: read
+    steps:
+    - uses: actions/checkout@v3
+    - # Activate cache export feature to reduce build time of image
+      name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v2
+    - name: Build the Docker image
+      run: make docker
+    - name: Login to Dockerhub
+      uses: docker/login-action@v2
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+    - name: Push image to Dockerhub
+      run: docker push ocrd/im6convert
+    - name: Alias the Docker image for GHCR
+      run: docker tag ocrd/im6convert ghcr.io/${{ github.repository }}
+    - name: Login to GitHub Container Registry
+      uses: docker/login-action@v2
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Push image to Github Container Registry
+      run: docker push ghcr.io/${{ github.repository }}
diff --git a/Dockerfile b/Dockerfile
index 6cf94df..cc60c8e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,17 @@
-FROM ocrd/core
-MAINTAINER OCR-D
+ARG DOCKER_BASE_IMAGE
+FROM $DOCKER_BASE_IMAGE
+ARG VCS_REF
+ARG BUILD_DATE
+LABEL \
+    maintainer="https://ocr-d.de/kontakt" \
+    org.label-schema.vcs-ref=$VCS_REF \
+    org.label-schema.vcs-url="https://github.com/OCR-D/ocrd_fileformat" \
+    org.label-schema.build-date=$BUILD_DATE
 ENV DEBIAN_FRONTEND noninteractive
 
 ENV PREFIX=/usr/local
 
-WORKDIR /build
+WORKDIR /build/ocrd_fileformat
 COPY ocrd-im6convert .
 COPY ocrd-tool.json .
 COPY Makefile .
@@ -13,11 +20,10 @@ RUN apt-get update && \
     apt-get -y install apt-utils && \
     apt-get -y install --no-install-recommends \
     ca-certificates \
-    make
-
-RUN make deps-ubuntu install
+    make && \
+    make deps-ubuntu install && \
+    rm -fr /build/ocrd_fileformat
+# smoke test
+RUN ocrd-fileformat-transform --version
 
 ENV DEBIAN_FRONTEND teletype
-
-# no fixed entrypoint (e.g. also allow `convert` etc)
-CMD ["/usr/local/bin/ocrd-im6convert", "--help"]
diff --git a/Makefile b/Makefile
index f304fc2..269f9b7 100644
--- a/Makefile
+++ b/Makefile
@@ -5,7 +5,8 @@ BINDIR = $(PREFIX)/bin
 SHAREDIR = $(PREFIX)/share/ocrd_im6convert
 
 # Docker tag
-DOCKER_TAG = ocrd/im6convert
+DOCKER_BASE_IMAGE ?= docker.io/ocrd/core:v2.69.0
+DOCKER_TAG ?= ocrd/im6convert
 
 # Python pip to install with ('$(PIP)')
 PIP ?= $(shell which pip)
@@ -64,4 +65,10 @@ uninstall:
 
 # Build Docker image
 docker:
-	docker build -t '$(DOCKER_TAG)' .
+	docker build \
+		--build-arg DOCKER_BASE_IMAGE=$(DOCKER_BASE_IMAGE) \
+		--build-arg VCS_REF=$$(git rev-parse --short HEAD) \
+		--build-arg BUILD_DATE=$$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+		-t '$(DOCKER_TAG)' .
+
+.PHONY: help deps deps-ubuntu install uninstall docker