diff --git a/test/run b/.github/workflows/test.sh
similarity index 72%
rename from test/run
rename to .github/workflows/test.sh
index 49af57a..68662be 100755
--- a/test/run
+++ b/.github/workflows/test.sh
@@ -1,7 +1,5 @@
-#!/bin/sh
-
-set -o errexit
-set -o xtrace
+#!/usr/bin/env bash
+set -exuo pipefail
 
 # test a docker process
 docker ps | grep -q caddy-gen
@@ -9,19 +7,19 @@ docker ps | grep -q caddy-gen
 # test availability and status code
 curl 127.0.0.1:80
 
-# test image size (see wemake-services/docker-image-size-limit)
-disl caddy-gen:latest 100MB
+# test image size < 100MB
+(( $(docker inspect caddy-gen:latest -f '{{.Size}}') < 100 * 2**20 ))
 
 # test feature CADDY_TEMPLATE
-printf 'http://test-template.localhost {\n  respond "template"\n}\n' > template.tmpl
-docker cp template.tmpl caddy-gen:/tmp/template.tmpl
+printf 'http://test-template.localhost {\n  respond "template"\n}\n' > /tmp/template.tmpl
+docker cp /tmp/template.tmpl caddy-gen:/tmp/template.tmpl
 docker exec caddy-gen sh -c 'export CADDY_TEMPLATE=/tmp/template.tmpl && sh /code/docker-entrypoint.sh'
 sleep 2
 test "$(curl 0.0.0.0:80 -s -H 'Host: test-template.localhost')" = 'template'
 
 # test feature CADDY_SNIPPET
-printf 'http://test-snippet.localhost {\n  respond "snippet"\n}\n' > snippet.tmpl
-docker cp snippet.tmpl caddy-gen:/tmp/snippet.tmpl
+printf 'http://test-snippet.localhost {\n  respond "snippet"\n}\n' > /tmp/snippet.tmpl
+docker cp /tmp/snippet.tmpl caddy-gen:/tmp/snippet.tmpl
 docker exec caddy-gen sh \
   -c 'export CADDY_TEMPLATE=/tmp/template.tmpl CADDY_SNIPPET=/tmp/snippet.tmpl && sh /code/docker-entrypoint.sh'
 sleep 2
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6dfcd9e..fe47689 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,30 +1,63 @@
 name: test
-
 on:
   push:
-    branches:
-      - master
+    branches: [master]
+    tags: ['**']
   pull_request:
   workflow_dispatch:
-
-concurrency: 
-  group: ${{ github.head_ref || github.run_id }}
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
-
 jobs:
   build:
     runs-on: ubuntu-latest
-
+    permissions:
+      contents: read
+      packages: write
     steps:
     - uses: actions/checkout@v4
-    - name: Set up Python
-      uses: actions/setup-python@v5
+    - uses: docker/setup-buildx-action@v3
+    - uses: docker/metadata-action@v5
+      id: meta
       with:
-        python-version: '3.9'
-    
-    - name: Run tests
+        images: |
+          ghcr.io/${{ github.repository }}
+          wemakeservices/caddy-gen
+        tags: |
+          type=ref,event=branch
+          type=semver,pattern={{version}}
+        labels: |
+          org.opencontainers.image.licenses=MIT
+    - uses: docker/login-action@v3
+      if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
+    - uses: docker/login-action@v3
+      if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags')
+      with:
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+    - name: docker build
+      uses: docker/build-push-action@v5
+      with:
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        context: .
+        load: true
+        tags: caddy-gen:latest
+    - name: test
       run: |
-        sh test/setup
-        # wait for container to start:
-        sleep 5
-        sh test/run
+        docker run -d -p 80:80 -v /var/run/docker.sock:/tmp/docker.sock:ro --name caddy-gen caddy-gen:latest
+        sleep 5  # wait for container to start
+        ./.github/workflows/test.sh
+    - name: docker push
+      uses: docker/build-push-action@v5
+      with:
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        context: .
+        push: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags') }}
+        tags: ${{ steps.meta.outputs.tags }}
+        labels: ${{ steps.meta.outputs.labels }}
diff --git a/README.md b/README.md
index 1e73271..2abc123 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ version: "3"
 services:
   caddy-gen:
     container_name: caddy-gen
-    image: "wemakeservices/caddy-gen:latest"
+    image: wemakeservices/caddy-gen:latest # or ghcr.io/wemake-services/caddy-gen:latest
     restart: always
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro # needs socket to read events
@@ -112,7 +112,7 @@ services:
       - ./caddy-info:/data/caddy
 ```
 
-### Add or modify reverse_proxy headers 
+### Add or modify reverse_proxy headers
 
 With the following settings, the upstream host will see its own address instead
 of the original incoming value. See [Headers](https://caddyserver.com/docs/caddyfile/directives/reverse_proxy#headers).
@@ -121,7 +121,7 @@ of the original incoming value. See [Headers](https://caddyserver.com/docs/caddy
 version: "3"
 services:
   caddy-gen:
-    image: "wemakeservices/caddy-gen:latest"
+    image: wemakeservices/caddy-gen:latest # or ghcr.io/wemake-services/caddy-gen:latest
     restart: always
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro # needs socket to read events
@@ -152,7 +152,7 @@ and only requests to `/api/*` will be routed to the whoami service.  See
 version: "3"
 services:
   caddy-gen:
-    image: "wemakeservices/caddy-gen:latest"
+    image: wemakeservices/caddy-gen:latest # or ghcr.io/wemake-services/caddy-gen:latest
     restart: always
     volumes:
       - /var/run/docker.sock:/tmp/docker.sock:ro # needs socket to read events
diff --git a/test/setup b/test/setup
deleted file mode 100755
index fc2fafb..0000000
--- a/test/setup
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-set -o errexit
-set -o xtrace
-
-# Adds dependencies:
-pip install docker-image-size-limit
-
-# Building image itself:
-docker build -t caddy-gen:latest .
-docker run -d -p 80:80 -v /var/run/docker.sock:/tmp/docker.sock:ro --name caddy-gen caddy-gen