diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index d6aa436..091f9db 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -10,9 +10,9 @@ jobs:
         runs-on: ubuntu-latest
         steps:
         - name: 'Checkout Repository'
-            uses: actions/checkout@v2
+          uses: actions/checkout@v2
         - name: Dependency Review
-            uses: github/dependency-review-action@v1
-            with:
-                # Possible values: "critical", "high", "moderate", "low"
-                fail-on-severity: 'high'
+          uses: actions/dependency-review-action@v1
+          with:
+            # Possible values: "critical", "high", "moderate", "low"
+            fail-on-severity: 'high'
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index 6baeaf9..dd6cc57 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -21,7 +21,7 @@ jobs:
 
       - name: self test
         id: selftest
-        uses: panagiotisptr/cov-diff@main
+        uses: ./
         with:
           path: .
           coverprofile: coverage.out
diff --git a/.github/workflows/publish-image.yaml b/.github/workflows/publish-image.yaml
new file mode 100644
index 0000000..84f9f96
--- /dev/null
+++ b/.github/workflows/publish-image.yaml
@@ -0,0 +1,46 @@
+name: Build coverage image
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE: ghcr.io/rewardstyle/cov-diff
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build image
+        run: |
+          docker build \
+            --tag "$IMAGE:sha-$GITHUB_SHA" \
+            --tag "$IMAGE:main" \
+            --label "org.opencontainers.image.source=https://github.com/rewardStyle/cov-diff" \
+            --label "org.opencontainers.image.revision=$GITHUB_SHA" \
+            .
+
+      - name: Smoke test image
+        run: docker run --rm "$IMAGE:sha-$GITHUB_SHA" cov-diff --help
+
+      - name: Log in to GitHub Container Registry
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Publish tested image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        run: |
+          docker push "$IMAGE:sha-$GITHUB_SHA"
+          docker push "$IMAGE:main"
diff --git a/Dockerfile b/Dockerfile
index 81087e7..2d09e08 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.21
+FROM mirror.gcr.io/library/golang:1.21
 
 WORKDIR /cov-diff
 COPY . /cov-diff
diff --git a/README.md b/README.md
index c253e4d..e1e23d7 100644
--- a/README.md
+++ b/README.md
@@ -60,3 +60,17 @@ jobs:
 ## Things to watch out for
 
 When generating the diff, keep in mind that the `target` branch will have commits that your `feature` branch won't. You'd normally get these changes if you merged the target branch into your feature branch right before opening the PR. In order to ignore these changes during the diff, you need to add the 3 dots (`...`) between the two branches (see example above). You can find the relevant documentation here: https://git-scm.com/docs/git-diff#Documentation/git-diff.txt-emgitdiffemltoptionsgtltcommitgtltcommitgt--ltpathgt82308203-1
+
+## Prebuilt LTK image
+
+The image workflow builds and smoke-tests `ghcr.io/rewardstyle/cov-diff` in hosted
+CI. Pull requests validate the image without publishing. Pushes to `main` publish
+the tested image with `sha-<full-commit-sha>` and `main` tags, using the repository's
+`GITHUB_TOKEN` rather than AWS credentials.
+
+Consumers can pin the published image by digest to avoid building the action's
+Dockerfile on each run. The existing `action.yaml` still uses its Dockerfile;
+switching consumers to the prebuilt image is a separate change after publication.
+
+New GHCR packages default to private. Anonymous pulls require the package to be
+made public explicitly; this workflow does not change package visibility.