diff --git a/.github/workflows/dockerhub.yaml b/.github/workflows/dockerhub.yaml
new file mode 100644
index 00000000..48ac5aaa
--- /dev/null
+++ b/.github/workflows/dockerhub.yaml
@@ -0,0 +1,25 @@
+name: Deploy Docker Image
+
+on:
+  create: ~
+
+jobs:
+  deploy:
+    if: ${{ startsWith(github.ref, 'refs/tags/v') }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+
+      - name: Build and push
+        id: docker_build
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: pseudomuto/protoc-gen-doc:${{ github.sha }}, pseudomuto/protoc-gen-doc:latest
diff --git a/Dockerfile b/Dockerfile
index 6c361727..951da3ea 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,11 @@
-FROM debian:jessie-slim
+FROM golang:1.17-alpine AS builder
+WORKDIR /build
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . ./
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o protoc-gen-doc ./cmd/protoc-gen-doc
+
+FROM debian:jessie-slim AS final
 LABEL maintainer="pseudomuto <david.muto@gmail.com>" protoc_version="3.6.1"
 
 WORKDIR /
@@ -12,8 +19,8 @@ RUN apt-get -q -y update && \
   apt-get autoremove && \
   rm -rf /var/lib/apt/lists/*
 
-ADD dist/protoc-gen-doc /usr/local/bin/
-ADD script/entrypoint.sh ./
+COPY --from=builder /build/protoc-gen-doc /usr/local/bin
+COPY script/entrypoint.sh ./
 
 VOLUME ["/out", "/protos"]
 
diff --git a/Makefile b/Makefile
index 093e8992..f89c2416 100644
--- a/Makefile
+++ b/Makefile
@@ -17,7 +17,7 @@ DOCKER_CMD=docker run --rm \
 	-v $(PWD)/thirdparty/github.com/mwitkow:/usr/local/include/github.com/mwitkow:ro \
 	-v $(PWD)/thirdparty/github.com/envoyproxy:/usr/local/include/github.com/envoyproxy:ro \
 	-v $(PWD)/tmp/googleapis/google/api:/usr/local/include/google/api:ro \
-	pseudomuto/protoc-gen-doc
+	pseudomuto/protoc-gen-doc:local
 
 VERSION = $(shell cat version.go | sed -n 's/.*const VERSION = "\(.*\)"/\1/p')
 
@@ -49,11 +49,9 @@ build: resources.go
 dist:
 	@script/dist.sh
 
-docker:
-	@script/push_to_docker.sh
-
-docker_test: build tmp/googleapis docker
+docker_test: tmp/googleapis
 	@rm -f examples/doc/*
+	@docker build -t pseudomuto/protoc-gen-doc:local .
 	@$(DOCKER_CMD) --doc_opt=docbook,example.docbook:Ignore*
 	@$(DOCKER_CMD) --doc_opt=html,example.html:Ignore*
 	@$(DOCKER_CMD) --doc_opt=json,example.json:Ignore*
diff --git a/script/push_to_docker.sh b/script/push_to_docker.sh
deleted file mode 100755
index 396e2287..00000000
--- a/script/push_to_docker.sh
+++ /dev/null
@@ -1,39 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-build_binary() {
-  mkdir -p dist
-  GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o dist/protoc-gen-doc ./cmd/...
-}
-
-build_and_tag_image() {
-  docker build -t "${1}" .
-  docker tag "${1}" "${2}:${3}"
-  docker tag "${1}" "${2}:latest"
-}
-
-push_image() {
-  # credentials are encrypted in travis.yml
-  docker login -u "${DOCKER_HUB_USER}" -p "${DOCKER_HUB_PASSWORD}"
-  docker push "${1}"
-  docker push "${2}:${3}"
-  docker push "${2}:latest"
-}
-
-main() {
-  local sha="${TRAVIS_COMMIT:-}"
-  if [ -z "${sha}" ]; then sha=$(git rev-parse HEAD); fi
-
-  local repo="pseudomuto/protoc-gen-doc"
-  local version="$(grep "const VERSION" "version.go" | awk '{print $NF }' | tr -d '"')"
-  local git_tag="${repo}:${sha}"
-
-  build_binary
-  build_and_tag_image "${git_tag}" "${repo}" "${version}"
-
-  if [ -n "${DOCKER_HUB_USER:-}" ]; then
-    push_image "${git_tag}" "${repo}" "${version}"
-  fi
-}
-
-main "$@"