diff --git a/.github/workflows/cleanup-pr-tag.yml b/.github/workflows/cleanup-pr-tag.yml
new file mode 100644
index 000000000..8625a3f42
--- /dev/null
+++ b/.github/workflows/cleanup-pr-tag.yml
@@ -0,0 +1,21 @@
+---
+name: Delete closed PR container image tag
+
+"on":
+  pull_request:
+    types:
+      - closed
+
+jobs:
+  cleanup-pr-tag:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set image version for PR to branch name
+        run: echo "VERSION=${GITHUB_HEAD_REF//\//-}" >> ${GITHUB_ENV}
+
+      - name: Delete PR container image tag
+        uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          tags: ${{ env.VERSION }}
+          package: ${{ github.event.repository.name }}
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 41f820ff9..50d8a092c 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -5,33 +5,63 @@ on:
     - master
     tags:
     - v*
+  pull_request: {}
 
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:
-      IMAGE: docker.io/${{ github.repository }}
     steps:
     - uses: actions/checkout@v6
       with:
-        fetch-depth: "0"
+        fetch-depth: 0 # NOTE(aa): Required in order to have tag information available
+    - name: Get version information
+      id: get-version-info
+      run: |
+        GITVERSION="$(git describe --tags --always --match=v* --dirty=+dirty || (echo "command failed $?"; exit 1))"
+        PYVERSION="$(git describe --tags --always --match=v* | cut -d- -f1,2 || (echo "command failed $?"; exit 1))"
+        echo "git version: $GITVERSION, pyversion: $PYVERSION"
+        echo "gitversion=${GITVERSION}" >> ${GITHUB_OUTPUT}
+        echo "pyversion=${PYVERSION}" >> ${GITHUB_OUTPUT}
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v3
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
     - name: Set image version latest
       if: github.ref == 'refs/heads/master'
       run: echo "VERSION=latest" >> ${GITHUB_ENV}
+    - name: Set image version for PRs to branch name
+      if: github.event_name == 'pull_request'
+      run: echo "VERSION=${GITHUB_HEAD_REF//\//-}" >> ${GITHUB_ENV}
     - name: Set image version from tag
       if: startsWith(github.ref, 'refs/tags/v')
       run: echo "VERSION=$(echo ${GITHUB_REF#refs/tags/})" >> ${GITHUB_ENV}
-    - name: Build Image
-      run: make docker
-      env:
-        IMAGE_NAME: "${IMAGE}:${VERSION}"
-    - name: Push Image
-      env:
-        DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-        DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-      run: |
-        docker login docker.io --username "${DOCKER_USERNAME}" --password "${DOCKER_PASSWORD}"
-        docker push "${IMAGE}:${VERSION}"
+    - name: Login to docker.io
+      if: github.event_name != 'pull_request'
+      uses: docker/login-action@v3
+      with:
+        registry: docker.io
+        username: ${{ secrets.DOCKER_USERNAME }}
+        password: ${{ secrets.DOCKER_PASSWORD }}
+    - name: Login to ghcr.io
+      uses: docker/login-action@v3
+      with:
+        registry: ghcr.io
+        username: ${{ github.repository_owner }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+    - name: Build and push
+      id: docker_build
+      uses: docker/build-push-action@v6
+      with:
+        platforms: linux/amd64,linux/arm64
+        push: true
+        tags: |
+          ghcr.io/${{ github.repository }}:${{ env.VERSION }}
+          ${{ github.event_name != 'pull_request' && format('{{docker.io/{0}:{1}}}', github.repository, env.VERSION) || '' }}
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+        build-args: |
+          GITVERSION=${{ steps.get-version-info.outputs.gitversion }}
+          PYVERSION=${{ steps.get-version-info.outputs.pyversion }}
     - name: Build changelog from PRs with labels
       if: startsWith(github.ref, 'refs/tags/v')
       id: build_changelog
@@ -74,3 +104,18 @@ jobs:
         # Ensure target branch for release is "master"
         commit: master
         token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Delete untagged container images
+      # We always delete all untagged container images after building an
+      # image. This way, there should never be stale untagged images laying
+      # around in the registry. In combination with the workflow that
+      # deletes PR tags after the PR is closed we should be able to keep the
+      # container image registry size in check.
+      uses: dataaxiom/ghcr-cleanup-action@v1
+      with:
+        token: ${{ secrets.GITHUB_TOKEN }}
+        package: ${{ github.event.repository.name }}
+        validate: true
+    - name: Run image
+      if: github.event_name == 'pull_request'
+      run: |
+        docker run ghcr.io/projectsyn/commodore:"${VERSION}" version
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index e6e48e4ee..7f545edea 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -150,17 +150,3 @@ jobs:
     - uses: actions/checkout@v6
     - name: Check Docs
       run: make docs-vale
-  build:
-    needs:
-    - lints
-    - tests
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-      with:
-        fetch-depth: "0"
-    - name: Build image
-      run: make docker
-    - name: Run image
-      run: |
-        docker run docker.io/projectsyn/commodore:test version