diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b8a1498..2069fb8a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -38,6 +38,12 @@ jobs:
             # on your needs.
             - name: Configure git for private modules
               run: git config --global url."https://speakeasybot:${{ secrets.BOT_REPO_TOKEN }}@github.com".insteadOf "https://github.com"
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+              with:
+                  registry: ghcr.io
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.BOT_REPO_TOKEN }}
             - name: Setup Choco
               uses: crazy-max/ghaction-chocolatey@2526f467ccbd337d307fe179959cabbeca0bc8c0 # v3.4.0
               with:
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 5f4aa8be..cfe731fa 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -15,6 +15,12 @@ builds:
       - linux
       - windows
       - darwin
+    goarch:
+      - amd64
+      - arm64
+    ignore:
+      - goos: windows
+        goarch: arm64  # Windows ARM64 can be enabled if needed
     ldflags:
       - "-s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}} -X main.builtBy=goreleaser -X main.artifactArch={{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
 archives:
@@ -32,6 +38,26 @@ changelog:
     exclude:
       - "^docs:"
       - "^test:"
+
+dockers_v2:
+  - id: speakeasy
+    dockerfile: Dockerfile
+    ids: [speakeasy]
+    images:
+      - ghcr.io/speakeasy-api/speakeasy
+    tags:
+      - "{{ .Tag }}"
+      - "latest"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      org.opencontainers.image.title: "{{ .ProjectName }}"
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.revision: "{{ .Commit }}"
+      org.opencontainers.image.source: "{{ .GitURL }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+
 brews:
   - name: speakeasy
     repository:
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 00000000..b9b0cd61
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,25 @@
+FROM debian:12-slim
+
+# Install only sudo (required by Speakeasy CLI)
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+    sudo \
+    && rm -rf /var/lib/apt/lists/*
+
+# Create a non-root user with sudo access
+RUN groupadd -g 1001 speakeasy && \
+    useradd -u 1001 -g speakeasy -m -s /bin/bash speakeasy && \
+    echo 'speakeasy ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
+
+USER speakeasy
+
+# Copy the binary from GoReleaser build context
+# GoReleaser will automatically use the correct binary for the target architecture
+COPY speakeasy /usr/local/bin/speakeasy
+
+# Make the binary executable
+RUN chmod +x /usr/local/bin/speakeasy
+
+# Default entrypoint
+ENTRYPOINT ["speakeasy"]
+CMD ["--version"]