diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
new file mode 100644
index 0000000..fce2c08
--- /dev/null
+++ b/.gitlab-ci.yml
@@ -0,0 +1,4 @@
+include:
+  - component: gitlab.com/TECHNOFAB/nix-gitlab-ci/nix-gitlab-ci@2.1.0
+    inputs:
+      version: 2.1.0
diff --git a/flake.nix b/flake.nix
index 2b29ec4..f5761c1 100644
--- a/flake.nix
+++ b/flake.nix
@@ -43,8 +43,10 @@
           };
         };
 
-        ci = {
-          stages = ["build"];
+        ci = let
+          SYSTEMS = ["x86_64-linux"];
+        in {
+          stages = ["build" "upload"];
           jobs = {
             "build" = {
               stage = "build";
@@ -55,11 +57,68 @@
                 ''
               ];
             };
+            "build:image" = {
+              stage = "build";
+              parallel.matrix = [
+                {SYSTEM = SYSTEMS;}
+              ];
+              script = [
+                "nix build .#oci-image --system $SYSTEM"
+              ];
+              after_script = [
+                "install -D result dist/image_\${SYSTEM}.tar.gz"
+              ];
+              artifacts.paths = ["dist/"];
+            };
+            "upload" = {
+              stage = "upload";
+              nix.deps = [pkgs.buildah];
+              needs = ["build:image"];
+              before_script = [
+                # sh
+                ''
+                  export REGISTRY_AUTH_FILE=''${HOME}/auth.json
+                  echo "$CI_REGISTRY_PASSWORD" | buildah login -u "$CI_REGISTRY_USER" --password-stdin $CI_REGISTRY
+                  mkdir -p /etc/containers &&
+                  echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json
+                  mkdir -p /var/tmp
+                ''
+              ];
+              script =
+                [
+                  # sh
+                  ''buildah manifest create localhost/go-copilot-proxy''
+                ]
+                ++ (
+                  builtins.map (sys:
+                    # sh
+                    ''
+                      buildah manifest add localhost/go-copilot-proxy docker-archive:dist/image_${sys}.tar.gz
+                    '')
+                  SYSTEMS
+                )
+                ++ [
+                  # sh
+                  ''
+                    buildah manifest push --all localhost/go-copilot-proxy \
+                      docker://''${CI_REGISTRY_IMAGE}/go-copilot-proxy:$CI_COMMIT_SHORT_SHA
+                  ''
+                ];
+            };
           };
         };
 
-        packages = {
+        packages = rec {
           default = pkgs.callPackage ./package.nix {};
+          oci-image = pkgs.dockerTools.buildImage {
+            name = "go-copilot-proxy";
+            tag = "latest";
+            copyToRoot = [default pkgs.cacert.out];
+            config = {
+              Cmd = ["/bin/go-copilot-proxy"];
+              Env = ["XDG_STATE_HOME=/tmp"];
+            };
+          };
         };
       };
     };