diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..be86c57
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,28 @@
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+webhookdb-cli
+webhookdb
+webhookdb.wasm
+
+dist/
+.env
+temp/
+
+.idea/
+*.yaml
+.gitignore
+.github
diff --git a/.github/workflows/deploy-dockerhub.yml b/.github/workflows/deploy-dockerhub.yml
new file mode 100644
index 0000000..35eabce
--- /dev/null
+++ b/.github/workflows/deploy-dockerhub.yml
@@ -0,0 +1,38 @@
+name: Build
+
+on:
+  release:
+    types: [ published ]
+
+jobs:
+  push_to_registry:
+    name: Push Docker image to Docker Hub
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the repo
+        uses: actions/checkout@v4
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: webhookdb/webhookdb-cli
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            GIT_REF=${{ github.ref }}
+            GIT_SHA=${{ github.sha }}
+            RELEASED_AT=$(date -u +"%Y-%m-%dT%H:%M:%SZ"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..ab21314
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,17 @@
+FROM golang:1.17
+
+WORKDIR /app
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . ./
+
+ARG RELEASED_AT="-"
+ARG GIT_SHA="-"
+ARG GIT_REF="-"
+
+RUN go build -ldflags "-X github.com/webhookdb/webhookdb-cli/config.BuildTime=${RELEASED_AT} -X github.com/webhookdb/webhookdb-cli/config.BuildSha=${GIT_SHA} -X github.com/webhookdb/webhookdb-cli/config.Version=${GIT_REF}" -o webhookdb
+
+ENTRYPOINT ["./webhookdb"]
diff --git a/Makefile b/Makefile
index 0359b14..463a1cb 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 BIN := ./webhookdb
 ARGS := WEBHOOKDB_API_HOST=http://localhost:18001
-BUILDFLAGS = "-X github.com/webhookdb/webhookdb-cli/config.BuildTime=`date -u +"%Y-%m-%dT%H:%M:%SZ"` -X github.com/webhookdb/webhookdb-cli/config.BuildSha=`git rev-list -1 HEAD`"
+BUILDFLAGS = "-X github.com/webhookdb/webhookdb-cli/config.BuildTime=`date -u +"%Y-%m-%dT%H:%M:%SZ"` -X github.com/webhookdb/webhookdb-cli/config.BuildSha=`git rev-list -1 HEAD` -X github.com/webhookdb/webhookdb-cli/config.Version=`git rev-parse --abbrev-ref HEAD`"
 WEBSITE = ../webhookdb-api/webhookdb-website
 
 ifdef GOROOT
@@ -62,6 +62,19 @@ wasm-server:
 
 build-all: build-arm64 build build-wasm
 
+docker-build:
+	docker build -f Dockerfile -t webhookdb-cli \
+    		--build-arg GIT_SHA=`git rev-list --abbrev-commit -1 HEAD` \
+    		--build-arg GIT_REF=`git rev-parse --abbrev-ref HEAD` \
+    		--build-arg RELEASED_AT=`date -u +"%Y-%m-%dT%H:%M:%SZ"` \
+    		.
+
+docker-run-version:
+	@docker run -it webhookdb-cli version --time
+
+docker-run-%:
+	@docker run -it webhookdb-cli $(*)
+
 docs: build
 	@DOCBUILD=true $(BIN) docs build
 docs-write: build ## Write a new copy of MANUAL.md.
diff --git a/appcontext/appcontext.go b/appcontext/appcontext.go
index 768b2ab..70784e7 100644
--- a/appcontext/appcontext.go
+++ b/appcontext/appcontext.go
@@ -106,5 +106,5 @@ var userAgent string
 
 func init() {
 	userAgent = fmt.Sprintf("WebhookDB/v1 webhookdb-cli/%s (%s; %s) Built/%s https://webhookdb.com",
-		config.BuildSha[:8], runtime.GOOS, runtime.GOARCH, config.BuildTime)
+		config.BuildShaShort, runtime.GOOS, runtime.GOARCH, config.BuildTime)
 }
diff --git a/cmd/cmd_version.go b/cmd/cmd_version.go
index f7b01a6..1b6c157 100644
--- a/cmd/cmd_version.go
+++ b/cmd/cmd_version.go
@@ -9,12 +9,13 @@ import (
 var versionCmd = &cli.Command{
 	Name:  "version",
 	Usage: "Print version and exit.",
+	Flags: []cli.Flag{&cli.BoolFlag{Name: "time"}},
 	Action: func(c *cli.Context) error {
-		shaPart := config.BuildSha
-		if len(shaPart) >= 8 {
-			shaPart = fmt.Sprintf(" (%s)", config.BuildSha[0:8])
-		}
+		shaPart := fmt.Sprintf(" (%s)", config.BuildShaShort)
 		fmt.Fprintf(c.App.Writer, "%s%s\n", config.Version, shaPart)
+		if c.Bool("time") {
+			fmt.Fprintf(c.App.Writer, "%s\n", config.BuildTime)
+		}
 		return nil
 	},
 }
diff --git a/config/config.go b/config/config.go
index 9aa3533..7fa1167 100644
--- a/config/config.go
+++ b/config/config.go
@@ -11,6 +11,7 @@ const UnknownVersion = "?.?.?"
 
 var BuildTime = "1970-01-01T00:00:00Z"
 var BuildSha = "0000000000000000000000000000000000000000"
+var BuildShaShort = ""
 var Version = UnknownVersion
 var Repo = "webhookdb/webhookdb-cli"
 
@@ -84,6 +85,10 @@ func lookupEnv(k, d string) string {
 const SentryDsnProd = "https://3e125fd192c34979b2f1a4a5ceb9abd6@o292308.ingest.sentry.io/6224206"
 
 func init() {
+	BuildShaShort = BuildSha
+	if len(BuildShaShort) > 8 {
+		BuildShaShort = BuildShaShort[0:8]
+	}
 	MustSetEnv("WEBHOOKDB_API_HOST", "https://api.production.webhookdb.com")
 	MustSetEnv("WEBHOOKDB_LOG_LEVEL", "error")
 }