diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
deleted file mode 100644
index d43a431f..00000000
--- a/.github/workflows/npm-publish.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-# This workflow will run tests using node and then publish a package to GitHub Packages when a release is created
-# For more information see: https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
-
-name: Publish to npm
-
-on:
-  push:
-    tags: ["[0-9]+.[0-9]+.[0-9]+*"]
-
-jobs:
-  publish-npm:
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-node@v1
-        with:
-          node-version: 14
-          registry-url: https://registry.npmjs.org/
-      - run: npm ci
-      - run: npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
new file mode 100644
index 00000000..1a7def95
--- /dev/null
+++ b/.github/workflows/publish.yml
@@ -0,0 +1,75 @@
+# Publish NPM package and Docker image
+name: Release
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  # Run tests using node, publish a package when tagged
+  # https://help.github.com/actions/language-and-framework-guides/publishing-nodejs-packages
+
+  publish-npm:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-node@v1
+        with:
+          node-version: 14
+          registry-url: https://registry.npmjs.org/
+      - run: npm ci
+      - run: npm publish
+        if: startsWith(github.ref, 'refs/tags/')
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.npm_token }}
+
+  publish-docker:
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v2
+
+      # Setup docker to build for multiple platforms (requires qemu).
+      # See:
+      # https://github.com/docker/build-push-action/tree/v2.3.0#usage
+      # https://github.com/docker/build-push-action/blob/v2.3.0/docs/advanced/multi-platform.md
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      # https://github.com/docker/login-action/tree/v1.8.0#docker-hub
+      - name: Login to Docker Hub
+        uses: docker/login-action@v1
+        if: startsWith(github.ref, 'refs/tags/')
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # https://github.com/jupyterhub/action-major-minor-tag-calculator
+      # If this is a tagged build this will return additional parent tags.
+      # E.g. 1.2.3 is expanded to Docker tags
+      # [{prefix}:1.2.3, {prefix}:1.2, {prefix}:1, {prefix}:latest] unless
+      # this is a backported tag in which case the newer tags aren't updated.
+      # For branches this will return the branch name.
+      # If GITHUB_TOKEN isn't available (e.g. in PRs) returns no tags [].
+      - name: Get list of tags
+        id: gettags
+        # TODO: Move to org?
+        uses: jupyterhub/action-major-minor-tag-calculator@main
+        with:
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          prefix: "jupyterhub/configurable-http-proxy:"
+
+      - name: Display tags
+        run: echo "Docker tags ${{ steps.gettags.outputs.tags }}"
+
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          platforms: linux/amd64,linux/arm64
+          push: ${{ startsWith(github.ref, 'refs/tags/') }}
+          # tags parameter must be a string input so convert `gettags` JSON
+          # array into a comma separated list of tags
+          tags: ${{ join(fromJson(steps.gettags.outputs.tags)) }}