diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..019e856
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,18 @@
+name: Build
+on:
+  push:
+    paths-ignore::
+      - "README.md"
+
+jobs:
+  build_matrix:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        target: [debug, release]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Build ${{ matrix.os }} - ${{ matrix.target }}
+        timeout-minutes: 6
+        uses: actions/checkout@v3.5.3
+      - run: make ${{ matrix.target }}
diff --git a/Dockerfile b/Dockerfile
index 0834ea7..7439ef9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,13 @@
-FROM debian:bookworm-slim as build
+FROM debian:bookworm-slim AS os-updated
 
+RUN apt-get update -qq && apt-get install -y git make cmake clang
+
+FROM os-updated AS build
 COPY . /code
 WORKDIR /code
-
-RUN apt-get update -qq && apt-get install -y \
-  build-essential git make pkg-config cmake libssl-dev
-
 RUN make release
 
-FROM debian:bookworm-slim
+FROM debian:bookworm-slim AS release
 COPY --from=build /code/pylon /usr/local/bin
+RUN apt-get clean
 ENTRYPOINT [ "/usr/local/bin/pylon" ]
diff --git a/README.md b/README.md
index a910a51..a03cfb2 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
 # ZeroTier Pylon
 Proxy layer 5 traffic from your apps to and from your ZeroTier virtual network without installing ZeroTier and without bringing up any new network interfaces.
 
+![Build](https://github.com/zerotier/pylon/actions/workflows/build.yml/badge.svg?branch=main)
+
 ## Build
 
 Currently the build process will pull a submodule (which itself pulls submodules), build libzt there, and then link pylon against the resultant `libzt.a` static library. Requires `clang`, and `cmake` to build.
diff --git a/makefile b/makefile
index 0930594..60d2738 100644
--- a/makefile
+++ b/makefile
@@ -1,12 +1,15 @@
 CXX=$(shell which clang++ g++ c++ 2>/dev/null | head -n 1)
 INCLUDES?=-Iext/libzt/ext/ZeroTierOne/osdep -Iext/libzt/ext/ZeroTierOne/ext/prometheus-cpp-lite-1.0/core/include -Iext/libzt/ext/ZeroTierOne/ext-prometheus-cpp-lite-1.0/3rdparty/http-client-lite/include -Iext/libzt/ext/ZeroTierOne/ext/prometheus-cpp-lite-1.0/simpleapi/include
 
+docker-release:
+	DOCKER_BUILDKIT=1 docker build --target=release --tag=pylon:latest .
+	docker cp `docker create --rm pylon`:/usr/local/bin/pylon .
 
 release:
 	git submodule update --init
 	git -C ext/libzt submodule update --init
 	cd ext/libzt && ./build.sh host "release"
-	$(CXX) -O3 $(INCLUDES) -Wno-deprecated -std=c++11 pylon.cpp -o pylon ext/libzt/dist/*-host-release/lib/libzt.a -Iext/libzt/include
+	$(CXX) -O3 $(INCLUDES) -Wno-deprecated -std=c++11 -static pylon.cpp -o pylon ext/libzt/dist/*-host-release/lib/libzt.a -Iext/libzt/include
 
 debug:
 	git submodule update --init