diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..5646188
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+.docker
+.git
diff --git a/.forgejo/workflows/build.yml b/.forgejo/workflows/build.yml
new file mode 100644
index 0000000..096dc68
--- /dev/null
+++ b/.forgejo/workflows/build.yml
@@ -0,0 +1,38 @@
+name: Build runner image
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: nixos
+    steps:
+      - name: Install checkout dependency
+        run: nix profile add nixpkgs#nodejs_24
+
+      - name: Check out repository
+        uses: https://data.forgejo.org/actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Configure registry authentication
+        env:
+          REGISTRY_USER: ${{ secrets.REGISTRY_USER }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -eu
+          mkdir -p .docker
+          AUTH="$(printf '%s' "$REGISTRY_USER:$REGISTRY_TOKEN" | base64 -w 0)"
+          printf '{"auths":{"git.methanium.net":{"auth":"%s"}}}\n' "$AUTH" > .docker/config.json
+
+      - name: Build and publish image
+        uses: docker://ghcr.io/osscontainertools/kaniko:v1.28.3
+        env:
+          DOCKER_CONFIG: ${{ forgejo.workspace }}/.docker
+        with:
+          entrypoint: /kaniko/executor
+          args: >-
+            --context=${{ forgejo.workspace }}
+            --dockerfile=${{ forgejo.workspace }}/Dockerfile
+            --destination=git.methanium.net/alois/nixos-docker-container:2.32.8
+            --push-retry=3
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..7e99aab
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,13 @@
+FROM docker.io/nixos/nix:2.32.8
+
+LABEL org.opencontainers.image.source="https://git.methanium.net/alois/nixos-docker-container"
+
+RUN nix profile add \
+    nixpkgs#bun \
+    nixpkgs#gnused \
+    nixpkgs#jdk21 \
+    nixpkgs#jq \
+    nixpkgs#nodejs_24 \
+    nixpkgs#pnpm \
+    nixpkgs#rsync \
+    nixpkgs#stdenv.cc
diff --git a/README.md b/README.md
index 1d81280..5bc9c0d 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,9 @@
-# nixos-docker-container
+Runner image: `git.methanium.net/alois/nixos-docker-container:2.32.8`
 
+Forgejo runner config:
+
+```yaml
+runner:
+  labels:
+    - nixos:docker://git.methanium.net/alois/nixos-docker-container:2.32.8
+```