diff --git a/.ko.yaml b/.ko.yaml
new file mode 100644
index 0000000..1a9cb8d
--- /dev/null
+++ b/.ko.yaml
@@ -0,0 +1 @@
+defaultBaseImage: cgr.dev/chainguard/static:latest
diff --git a/.tangled/workflows/ci.yml b/.tangled/workflows/ci.yml
index f43f596..7b27009 100644
--- a/.tangled/workflows/ci.yml
+++ b/.tangled/workflows/ci.yml
@@ -12,6 +12,7 @@ dependencies:
     - gnugrep
     - gawk
     - coreutils
+    - docker
 
 steps:
   - name: "Test with coverage"
@@ -19,3 +20,12 @@ steps:
       CGO_ENABLED: "0"
     command: |
       ./check-coverage
+
+  - name: "Build and push image"
+    environment:
+      CGO_ENABLED: "0"
+      KO_DOCKER_REPO: "atcr.io/guid.foo/wicket"
+    command: |
+      go install github.com/google/ko@latest
+      echo "${ATCR_APP_PASSWORD}" | docker login atcr.io -u guid.foo --password-stdin
+      ko build --bare --tags "latest,$(date -u +%Y%m%d%H%M%S)-$(git rev-parse --short HEAD)" .