diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..70de682d6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,56 @@
+name: Build Docker Image
+
+# Release on any git tag
+on:
+  push:
+    tags: ['*']
+
+jobs:
+  build:
+    runs-on: [self-hosted, linux, nixos]
+    strategy:
+      matrix:
+        config:
+          - blastoise
+    outputs:
+      cache-key: ${{ steps.build.outputs.cache-key }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # Checkout the triggered tag name
+          ref: ${{ github.ref_name }}
+      - name: Build docker image file
+        id: build
+        run: |
+          closure="$(nix build -L '.#t1.${{ matrix.config }}.release.docker-layers.final-image' --no-link --print-out-paths)"
+          echo "path: $closure"
+          cp "$closure/image.tar" /tmp/t1-image.tar
+          echo "cache-key=$(nix hash file --base32 /tmp/t1-image.tar)" > $GITHUB_OUTPUT
+      - name: Upload to cache
+        uses: actions/cache/save@v4
+        with:
+          path: /tmp/t1-image.tar
+          key: ${{ steps.build.outputs.cache-key }}
+
+  upload:
+    runs-on: ubuntu-latest
+    needs: [build]
+    steps:
+      - name: Restore from cache
+        uses: actions/cache/restore@v4
+        id: cache
+        with:
+          path: /tmp/t1-image.tar
+          fail-on-cache-miss: true
+          key: ${{ needs.build.outputs.cache-key }}
+      - name: Login to GHCR dot IO
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Load and push
+        run: |
+          docker load < /tmp/t1-image.tar
+          docker tag t1/release:latest ghcr.io/chipsalliance/t1:latest
+          docker push ghcr.io/chipsalliance/t1:latest
diff --git a/README.md b/README.md
index 962c71dab..d913bc84f 100644
--- a/README.md
+++ b/README.md
@@ -64,6 +64,12 @@ For tuning the ideal vector machines, follow these performance-tuning methodolog
 
 We have a IP emulator under the directory `./ipemu`. [Spike](https://github.com/riscv/riscv-isa-sim) is used as the reference scalar core, integrated with the verilated vector IP. Under the online differential-test strategy, the emulator compares the load/store and VRF writes between Spike and T1 to verify T1’s correctness.
 
+### Docker images
+
+```bash
+docker pull ghcr.io/chipsalliance/t1:latest
+```
+
 ### Nix setup
 We use Nix Flake as our primary build system. If you have not installed nix, install it following the [guide](https://nixos.org/manual/nix/stable/installation/installing-binary.html), and enable flake following the [wiki](https://nixos.wiki/wiki/Flakes#Enable_flakes). Or you can try the [installer](https://github.com/DeterminateSystems/nix-installer) provided by Determinate Systems, which enables flake by default.