diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..fd1e9e9
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,72 @@
+name: ci
+
+on:
+  push:
+    branches:
+      - '**'
+    tags:
+      - '**'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version'
+        default: 'latest'
+        required: false
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ghcr.io/WIPACRepo/indico-container
+          tags: |
+            type=ref,event=branch
+            type=semver,pattern={{major}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}.{{minor}}.{{patch}}
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v3
+        if: ${{ github.event_name != 'pull_request' }}
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Tag version
+        if: ${{ startsWith( github.ref_name , 'v') }}
+        id: tag
+        run: |
+          TAG="${{ github.ref_name }}"
+          TAG2=${TAG:1}
+          echo "tag=$TAG2"
+          echo "tag=$TAG2" >> "$GITHUB_OUTPUT"
+
+      - name: Build and push (Tag)
+        if: ${{ startsWith( github.ref_name , 'v') }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ steps.tag.outputs.tag }}
+
+      - name: Build and push
+        if: ${{ ! startsWith( github.ref_name , 'v') }}
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            VERSION=${{ github.event.inputs.version || 'latest' }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..79214d5
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,49 @@
+name: release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version'
+        default: 'latest'
+        required: false
+  schedule:
+    - cron: "0 2 * * *"
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - id: runner
+        uses: pozetroninc/github-action-get-latest-release@master
+        with:
+          owner: indico
+          repo: indico
+          excludes: prerelease, draft
+
+      - name: Tag name
+        id: tag
+        run: |
+          SRC_TAG=${{ steps.runner.outputs.release }}
+          echo "Upstream release = indico/indico-containers: ${SRC_TAG}"
+          if [ "${{ github.event.inputs.version || 'latest' }}" = "latest" ]; then
+            export TAG="${{ steps.runner.outputs.release }}"
+          else
+            export TAG="${SRC_TAG#v}"
+          fi
+          echo "Generating tag: $TAG"
+          echo "tag=$TAG" >> "$GITHUB_OUTPUT"
+
+      - uses: mukunku/tag-exists-action@v1.6.0
+        id: checkTag
+        with:
+          tag: ${{ steps.tag.outputs.tag }}
+
+      - name: Create Release
+        if: ${{ steps.checkTag.outputs.exists == 'false' }}
+        uses: "marvinpinto/action-automatic-releases@latest"
+        with:
+          repo_token: "${{ secrets.PERSONAL_ACCESS_TOKEN }}"
+          automatic_release_tag: "${{ steps.tag.outputs.tag }}"
+          prerelease: false
+          title: "${{ steps.tag.outputs.tag }}"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..a0ea605
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,13 @@
+ARG VERSION=latest
+
+ARG pip="/opt/indico/.venv/bin/pip"
+
+FROM ghcr.io/indico/indico:$VERSION
+
+# all the installations etc can be done using the unprivileged indico user
+USER indico
+
+RUN ${pip} install https://github.com/WIPACrepo/indico-sso-plugin.git
+
+ENTRYPOINT ["/opt/indico/docker_entrypoint.sh"]
+EXPOSE 59999