diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ca9e617f2..9c34fefa8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,18 +2,23 @@ name: release
 
 on:
   push:
-    # run only against tags
+    # run only against version tags
     tags:
-      - "*"
+      - "v*"
 
 permissions:
   contents: write
+  packages: write
+  id-token: write # keyless cosign signing
 
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     env:
-      # true if tag-name doesn't contain a hyphen (eg. v1.2.3-dev, 1.2.4-nightly), false otherwise
+      # Evaluates to the string "true" or "false". true if tag-name doesn't
+      # contain a hyphen (eg. v1.2.3-dev, 1.2.4-nightly), false otherwise.
+      # GoReleaser templates consume this as a string comparison for the
+      # conditional :latest container tag.
       MAKE_LATEST_RELEASE: ${{ contains(github.ref_name, '-') == false }}
     steps:
       - name: Checkout
@@ -26,6 +31,22 @@ jobs:
         with:
           go-version: stable
 
+      - name: Install cosign
+        uses: sigstore/cosign-installer@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
         with:
@@ -40,3 +61,4 @@ jobs:
           MAKE_LATEST_RELEASE: ${{ env.MAKE_LATEST_RELEASE }}
           # If using goreleaser-pro, uncomment the following line
           # GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+
diff --git a/.goreleaser.yml b/.goreleaser.yml
index 8885a4991..987c871ad 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -64,6 +64,36 @@ builds:
     # Templates: allowed.
     mod_timestamp: "{{ .CommitTimestamp }}"
 
+dockers_v2:
+  - id: plakar
+    ids:
+      - plakar
+    images:
+      - "ghcr.io/plakarkorp/plakar"
+    tags:
+      - "{{ .Tag }}"
+      - '{{ if eq .Env.MAKE_LATEST_RELEASE "true" }}latest{{ end }}'
+    dockerfile: Dockerfile
+    flags:
+      - "--target=goreleaser"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      "org.opencontainers.image.source": "https://github.com/PlakarKorp/plakar"
+      "org.opencontainers.image.version": "{{ .Version }}"
+      "org.opencontainers.image.created": "{{ .Date }}"
+      "org.opencontainers.image.title": "plakar"
+      "org.opencontainers.image.revision": "{{ .FullCommit }}"
+
+docker_signs:
+  - cmd: cosign
+    output: true
+    args:
+      - sign
+      - "${artifact}"
+      - "--yes"
+
 nfpms:
   - package_name: plakar
 
diff --git a/Dockerfile b/Dockerfile
index fa89d603e..39357e310 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,7 +5,26 @@
 #   persistent volume at the plakar cache directory, e.g.:
 #       docker run -v plakar-cache:/home/plakar/.cache/plakar ...
 #
-# Stage 1: Build
+# Stage 1: Shared runtime base
+FROM alpine:3.23 AS runtime-base
+
+# CA certificates for HTTPS connections to remote repositories and plakar.io
+RUN apk add --no-cache ca-certificates
+
+# Create non-root user (/etc/passwd required by user.Current())
+RUN addgroup -S plakar && adduser -S -G plakar -h /home/plakar plakar
+
+USER plakar
+WORKDIR /home/plakar
+
+ENTRYPOINT ["plakar"]
+
+# Stage 2: GoReleaser runtime image (binary provided via GoReleaser build context)
+FROM runtime-base AS goreleaser
+ARG TARGETPLATFORM
+COPY ${TARGETPLATFORM}/plakar /usr/local/bin/plakar
+
+# Stage 3: Build from source for manual Docker builds
 FROM golang:1.25-alpine AS builder
 
 WORKDIR /src
@@ -20,18 +39,7 @@ COPY . .
 # Build static binary matching goreleaser configuration
 RUN CGO_ENABLED=0 go build -trimpath -v -o /plakar .
 
-# Stage 2: Runtime
-FROM alpine:3.23
-
-# CA certificates for HTTPS connections to remote repositories and plakar.io
-RUN apk add --no-cache ca-certificates
-
-# Create non-root user (/etc/passwd required by user.Current())
-RUN addgroup -S plakar && adduser -S -G plakar -h /home/plakar plakar
+# Stage 4: Runtime image for manual Docker builds
+FROM runtime-base
 
 COPY --from=builder /plakar /usr/local/bin/plakar
-
-USER plakar
-WORKDIR /home/plakar
-
-ENTRYPOINT ["plakar"]