diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index c44a11a..d9bce9d 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -6,33 +6,15 @@ on:
 name: Build & Test
 
 jobs:
-
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v5
-
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
-
-      - name: Run Build
-        run: go build .
-
-  test:
-    name: Test
+  build-test:
+    name: Build & Test
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
         uses: actions/checkout@v5
 
-      - name: Install Go
-        uses: actions/setup-go@v6
-        with:
-          go-version-file: "go.mod"
+      - name: Build Container Image
+        run: make image-build
 
       - name: Run Tests
-        run: go test -v ./...
+        run: make test
diff --git a/Containerfile b/Containerfile
index 093a73c..913820e 100644
--- a/Containerfile
+++ b/Containerfile
@@ -1,11 +1,20 @@
-ARG GO_VERSION=1.25.3
-FROM docker.io/golang:${GO_VERSION} AS builder
+ARG GO_CONTAINER_IMAGE
+
+# Stage 1: Build the binary.
+FROM ${GO_CONTAINER_IMAGE} AS builder
+
+ARG VERSION
 
 WORKDIR /app
-COPY . .
+COPY go.mod go.sum ./
+RUN go mod download
 
-RUN CGO_ENABLED=0 go build .
+COPY . .
+RUN CGO_ENABLED=0 go build \
+    -ldflags "-s -w -X k8s.io/component-base/version.gitVersion=${VERSION}" \
+    .
 
+# Stage 2: Minimal container image.
 FROM gcr.io/distroless/static-debian12:nonroot
 
 COPY --from=builder /app/oxide-cloud-controller-manager /usr/bin/oxide-cloud-controller-manager
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..8c8fbb6
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,45 @@
+VERSION ?= 0.1.0-$(GIT_COMMIT_SHORT)
+GO_CONTAINER_IMAGE ?= docker.io/golang:1.25.3
+
+CONTAINER_RUNTIME ?= $(shell command -v podman 2>/dev/null || command -v docker 2>/dev/null)
+ifeq ($(CONTAINER_RUNTIME),)
+$(error No container runtime found. Please install podman or docker)
+endif
+
+GIT_COMMIT_SHORT := $(shell git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+
+# Container image configuration.
+IMAGE_REGISTRY ?= ghcr.io/oxidecomputer
+IMAGE_NAME ?= oxide-cloud-controller-manager
+IMAGE_TAG ?= $(VERSION)
+IMAGE_FULL ?= $(if $(IMAGE_REGISTRY),$(IMAGE_REGISTRY)/)$(IMAGE_NAME):$(IMAGE_TAG)
+
+.PHONY: test
+test:
+	@echo "Running tests in container..."
+	$(CONTAINER_RUNTIME) build \
+		--build-arg GO_CONTAINER_IMAGE=$(GO_CONTAINER_IMAGE) \
+		--build-arg VERSION=$(VERSION) \
+		--target builder \
+		-t $(IMAGE_NAME)-builder:$(IMAGE_TAG) \
+		.
+	$(CONTAINER_RUNTIME) run --rm $(IMAGE_NAME)-builder:$(IMAGE_TAG) go test -v ./...
+
+.PHONY: image-build
+image-build:
+	@echo "Building container image: $(IMAGE_FULL)"
+	$(CONTAINER_RUNTIME) build \
+		--build-arg GO_CONTAINER_IMAGE=$(GO_CONTAINER_IMAGE) \
+		--build-arg VERSION=$(VERSION) \
+		-t $(IMAGE_FULL) \
+		.
+
+.PHONY: image-push
+image-push:
+	@if [ -z "$(IMAGE_REGISTRY)" ]; then \
+		echo "Error: IMAGE_REGISTRY must be set to push images"; \
+		echo "Example: make image-push IMAGE_REGISTRY=ghcr.io/oxidecomputer"; \
+		exit 1; \
+	fi
+	@echo "Pushing container image: $(IMAGE_FULL)"
+	$(CONTAINER_RUNTIME) push $(IMAGE_FULL)