diff --git a/.github/workflows/spider-compose.yaml b/.github/workflows/spider-compose.yaml
new file mode 100644
index 00000000..e1046053
--- /dev/null
+++ b/.github/workflows/spider-compose.yaml
@@ -0,0 +1,91 @@
+name: "spider-compose"
+
+on:
+  pull_request:
+    paths: &monitored_paths
+      - ".github/workflows/spider-compose.yaml"
+      - "taskfile.yaml"
+      - "taskfiles/docker.yaml"
+      - "tools/deployment/spider-compose/**"
+      - "tools/yscope-dev-utils"
+  push:
+    branches: ["main"]
+    paths: *monitored_paths
+    tags: ["spider-huntsman-v*"]
+  schedule:
+    # Run daily at 00:15 UTC (the 15 is to avoid periods of high load)
+    - cron: "15 0 * * *"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: "${{github.workflow}}-${{github.ref}}"
+
+  # Cancel in-progress jobs for efficiency. Exclude the `main` branch to allow uninterrupted
+  # publishing of Docker Compose OCI artifacts.
+  cancel-in-progress: "${{github.ref != 'refs/heads/main'}}"
+
+jobs:
+  validate:
+    runs-on: "ubuntu-latest"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+        with:
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - name: "Validate Docker Compose configuration"
+        shell: "bash"
+        run: "task docker:compose:validate"
+
+  publish:
+    if: "github.event_name != 'pull_request'"
+    needs: "validate"
+    runs-on: "ubuntu-latest"
+    permissions:
+      contents: "read"
+      packages: "write"
+    steps:
+      - uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"  # v7.0.1
+        with:
+          persist-credentials: false
+          submodules: "recursive"
+
+      - uses: "./tools/yscope-dev-utils/exports/github/actions/install-go-task"
+        with:
+          version: "3.48.0"
+
+      - uses: "oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d"  # v2.0.1
+        with:
+          version: "1.3.3"
+
+      - name: "Sanitize repository name"
+        id: "repo"
+        run: >-
+          echo "name=${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+
+      - name: "Get artifact tag"
+        id: "artifact"
+        shell: "bash"
+        run: |-
+          tag="nightly"
+          if [[ "${GITHUB_EVENT_NAME}" == "push" && "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            tag="${GITHUB_REF_NAME}"
+          fi
+          echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+
+      - uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
+        with:
+          registry: "ghcr.io"
+          username: "${{github.actor}}"
+          password: "${{secrets.GITHUB_TOKEN}}"
+
+      - name: "Publish Docker Compose OCI artifact"
+        shell: "bash"
+        run: >-
+          task docker:compose:publish
+          OCI_REFERENCE='ghcr.io/${{steps.repo.outputs.name}}/compose:${{steps.artifact.outputs.tag}}'
diff --git a/taskfiles/docker.yaml b/taskfiles/docker.yaml
index 6c834fd4..ecdd3b5f 100644
--- a/taskfiles/docker.yaml
+++ b/taskfiles/docker.yaml
@@ -27,6 +27,19 @@ tasks:
     dir: "{{.G_SPIDER_COMPOSE_DIR}}"
     cmd: "docker compose --env-file .env.example --file compose.yaml config --quiet"
 
+  compose:publish:
+    requires:
+      vars: ["OCI_REFERENCE"]
+    deps: ["compose:validate"]
+    dir: "{{.G_SPIDER_COMPOSE_DIR}}/.."
+    cmd: >-
+      oras push
+      --artifact-type "application/vnd.yscope.spider.compose"
+      '{{.OCI_REFERENCE}}'
+      "spider-compose/compose.yaml:application/yaml"
+      "spider-compose/configs/:application/vnd.yscope.spider.compose.configs.tar"
+      "spider-compose/.env.example:text/plain"
+
   compose:up:
     dir: "{{.G_SPIDER_COMPOSE_DIR}}"
     cmd: "docker compose --file compose.yaml up --detach --wait --wait-timeout 300"