diff --git a/.build.sh b/.build.sh
deleted file mode 100755
index 608d82e..0000000
--- a/.build.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/bin/bash
-set -Eeuxo pipefail
-
-# unclear why these are needed as they _should_ already be done in the docker image build...
-mix local.hex --force
-mix local.rebar --force
-mix deps.get
-mix compile
-mix pleroma.frontend install pleroma-fe --ref stable
-mix pleroma.frontend install admin-fe --ref stable
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..18f835a
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,3 @@
+*
+!akkoma
+!prod.secret.exs
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..54338cb
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+akkoma
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..13fe3ca
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,21 @@
+ARG AKKOMA_COMMIT
+FROM registry.nrd.li/nrdli/akkoma-base:${AKKOMA_COMMIT}
+
+ENV PROD_SECRET_FILE=/config/prod.secret.exs
+
+USER root
+WORKDIR /
+RUN mkdir -p "$(dirname "${PROD_SECRET_FILE}")" && \
+  chown -R 1000:1000 "$(dirname "${PROD_SECRET_FILE}")" && \
+  rm -rf /opt/akkoma
+
+USER akkoma
+ADD --chown=akkoma:akkoma prod.secret.exs ${PROD_SECRET_FILE}
+ADD --chown=akkoma:akkoma akkoma /opt/akkoma
+
+WORKDIR /opt/akkoma
+RUN mix local.hex --force && mix local.rebar --force
+RUN mix deps.get
+RUN mix compile
+RUN mix pleroma.frontend install pleroma-fe --ref stable
+RUN mix pleroma.frontend install admin-fe --ref stable
diff --git a/build.sh b/build.sh
index 213bc89..cc15665 100755
--- a/build.sh
+++ b/build.sh
@@ -1,8 +1,8 @@
 #!/bin/bash
 set -Eeuxo pipefail
 
-AKKOMA_COMMIT="024578a659d453ae61e7535cb73758f760af375a"
-AKKOMA_BASE_IMAGE="registry.nrd.li/nrdli/akkoma:${AKKOMA_COMMIT}"
+LOCAL_COMMIT="$(git rev-parse HEAD)"
+AKKOMA_FINAL_IMAGE="registry.nrd.li/nrdli/akkoma:${LOCAL_COMMIT}"
 
 # clone akkoma source code
 if [ -d akkoma ]; then
@@ -10,11 +10,10 @@ if [ -d akkoma ]; then
 fi
 git clone https://git.keganmyers.com/nrd.li/akkoma.git akkoma
 pushd akkoma
-git fetch --all
-git checkout "${AKKOMA_COMMIT}"
-if [ "$(git rev-parse HEAD)" != "${AKKOMA_COMMIT}" ]; then
-  exit 1
-fi
+git checkout stable
+git pull
+AKKOMA_COMMIT="$(git rev-parse HEAD)"
+AKKOMA_BASE_IMAGE="registry.nrd.li/nrdli/akkoma-base:${AKKOMA_COMMIT}"
 
 # build and store base image
 docker build \
@@ -26,12 +25,8 @@ popd
 chown -R 1000:1000 ./akkoma
 
 # run install steps for akkoma
-docker run --rm \
-  -itv "$(pwd)/akkoma:/opt/akkoma" \
-  -v "$(pwd)/prod.secret.exs:/config/prod.secret.exs" \
-  -v "$(pwd)/.build.sh:/build.sh" \
-  -e "PROD_SECRET_FILE=/config/prod.secret.exs" \
-  --entrypoint "" \
-  "${AKKOMA_BASE_IMAGE}" \
-  /build.sh
-# docker push "${AKKOMA_FINAL_IMAGE}"
+docker build \
+  -t "${AKKOMA_FINAL_IMAGE}" \
+  --build-arg "AKKOMA_COMMIT=${AKKOMA_COMMIT}" \
+  .
+docker push "${AKKOMA_FINAL_IMAGE}"