diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index 6e8635b..084b1b7 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -76,6 +76,7 @@ jobs:
           platforms: linux/${{ matrix.arch }}
           push: true
           provenance: false
+          build-args: GOARCH=${{ matrix.arch }}
           tags: |
             ${{ env.DOCKER_REGISTRY }}/t.behrendt/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}-${{ matrix.arch }}
 
diff --git a/Dockerfile b/Dockerfile
index 9ca09e2..079eb99 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,14 @@
-FROM golang:1.23-alpine
+FROM golang:1.23-alpine as build
+
+ARG GOARCH=amd64
 
 WORKDIR /app
-
 COPY go.mod go.sum ./
-
 RUN go mod download
-
 COPY . .
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${GOARCH} \
+    go build -trimpath -ldflags="-s -w" -o main .
 
-RUN go build -o main .
-
-CMD ["./main"]
+FROM gcr.io/distroless/static-debian12
+COPY --from=build /app/main /
+CMD ["/main"]