diff --git a/.github/workflows/buildkite-image.yml b/.github/workflows/buildkite-image.yml
new file mode 100644
index 00000000..2e530493
--- /dev/null
+++ b/.github/workflows/buildkite-image.yml
@@ -0,0 +1,50 @@
+name: Buildkite image
+
+on:
+  pull_request:
+    paths:
+      - 'buildkite/**'
+      - '.github/workflows/buildkite-image.yml'
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    env:
+      IMAGE: ghcr.io/${{ github.repository }}/buildkite
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Build image
+        run: docker build --pull --tag buildkite:test buildkite
+
+      - name: Smoke-test image
+        run: |
+          docker run --rm --entrypoint /bin/sh buildkite:test -ec '
+            buildkite-agent --version
+            dmd --version
+            dub --version
+            test -x /usr/local/bin/get_travis_test_script
+          '
+
+      - name: Log in to GHCR
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        env:
+          GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "$GHCR_TOKEN" | docker login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
+      - name: Publish image
+        if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+        run: |
+          IMAGE="${IMAGE,,}"
+          docker tag buildkite:test "$IMAGE:$GITHUB_SHA"
+          docker tag buildkite:test "$IMAGE:latest"
+          docker push "$IMAGE:$GITHUB_SHA"
+          docker push "$IMAGE:latest"
diff --git a/README.md b/README.md
index 54d747d5..ae49089e 100644
--- a/README.md
+++ b/README.md
@@ -31,3 +31,9 @@ Pre-installed dependencies on buildkite agents
 ----------------------------------------------
 
 The server infrastructure is maintained using ansible and a list of pre-installed test dependencies can be found [here](/ansible/roles/test_deps/tasks/main.yml). Send us a PR if you need something that isn't yet installed.
+
+The [Buildkite Docker image](buildkite/Dockerfile) is built and smoke-tested on pull
+requests that change `buildkite/**` or its [workflow](.github/workflows/buildkite-image.yml).
+Every push to `master`, including merged pull requests, builds and tests the image
+before publishing it to `ghcr.io/dlang/ci/buildkite:latest` and a tag containing the
+full commit SHA. Publishing uses the repository's `GITHUB_TOKEN`.