diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 0000000..975f5cd
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,24 @@
+name: Build and publish
+
+on:
+  push:
+    branches: [ master ]
+
+permissions:
+  contents: read
+
+jobs:
+  publish-docker-image:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+      - run: make publish
+        env:
+          TAG: docker.io/${{ secrets.DOCKER_HUB_USERNAME }}/${{ secrets.DOCKER_HUB_REPOSITORY }}:latest
+          BUILDX_CACHE_ARGS: --cache-from type=gha --cache-to type=gha,mode=max
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
new file mode 100644
index 0000000..35b8f7d
--- /dev/null
+++ b/.github/workflows/pull_request.yml
@@ -0,0 +1,19 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [ master ]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - run: make build test
+        env:
+          PLATFORMS: linux/amd64
+          BUILDX_CACHE_ARGS: --cache-from type=gha --load
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..fd170c8
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+ARG DOCKER_REGISTRY=registry-1.docker.io
+FROM ${DOCKER_REGISTRY}/library/postgres:16.13-alpine3.23@sha256:4e6e670bb069649261c9c18031f0aded7bb249a5b6664ddec29c013a89310d50
+
+ARG PGAUDIT_VERSION=16.1
+ARG PGAUDIT_SHA256_HASH=01343a72d7eff31e40c8e646dd17f236dc07389205f57ab13000298f38f0a9fd
+
+RUN apk add --no-cache --virtual .build-deps \
+  curl \
+  unzip \
+  make \
+  gcc \
+  musl-dev \
+  postgresql-dev \
+  krb5-dev \
+  libc-dev \
+  llvm19 \
+  clang19
+
+WORKDIR /pgaudit
+RUN curl -fL -O https://github.com/pgaudit/pgaudit/archive/refs/tags/${PGAUDIT_VERSION}.zip \
+  && echo "${PGAUDIT_SHA256_HASH}  ${PGAUDIT_VERSION}.zip" | sha256sum -c - \
+  && unzip ${PGAUDIT_VERSION}.zip \
+  && make -C ./pgaudit-${PGAUDIT_VERSION} install USE_PGXS=1 PG_CONFIG=/usr/local/bin/pg_config \
+  && apk del .build-deps \
+  && rm -rf /pgaudit
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..b3410e7
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,27 @@
+TAG ?= dintero/docker-postgres-pgaudit
+DOCKER_BUILDKIT ?= 1
+PLATFORMS ?= linux/amd64,linux/arm64
+BUILDX_CACHE_ARGS ?=
+
+build:
+	docker buildx build --platform $(PLATFORMS) --tag $(TAG) $(BUILDX_CACHE_ARGS) .
+
+publish:
+	docker buildx build --platform $(PLATFORMS) --tag $(TAG) $(BUILDX_CACHE_ARGS) --push .
+
+test:
+	docker rm -f pgaudit-test >/dev/null 2>&1 || true
+	@sh -c '\
+		trap "docker rm -f pgaudit-test >/dev/null 2>&1" EXIT; \
+		docker run -d --name pgaudit-test -e POSTGRES_PASSWORD=test $(TAG) -c shared_preload_libraries=pgaudit; \
+		i=0; \
+		until docker exec pgaudit-test pg_isready -U postgres >/dev/null 2>&1; do \
+			i=$$((i+1)); \
+			if [ $$i -ge 30 ]; then echo "timed out waiting for postgres"; docker logs pgaudit-test; exit 1; fi; \
+			sleep 1; \
+		done; \
+		docker exec pgaudit-test psql -U postgres -c "CREATE EXTENSION pgaudit;"; \
+		docker exec pgaudit-test psql -U postgres -c "SHOW pgaudit.log;"; \
+	'
+
+install: build test