diff --git a/.github/rvu/labels.yaml b/.github/rvu/labels.yaml
new file mode 100644
index 00000000..7b192d61
--- /dev/null
+++ b/.github/rvu/labels.yaml
@@ -0,0 +1 @@
+service.rvu.co.uk/brand: airship
diff --git a/.github/workflows/CD.yaml b/.github/workflows/CD.yaml
deleted file mode 100644
index 062318dd..00000000
--- a/.github/workflows/CD.yaml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: CD
-
-on: [push, pull_request]
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v2
-
-      - name: Setup Go
-        uses: actions/setup-go@v2
-        with:
-          go-version: '1.14.0'
-
-      - name: Build
-        run: |
-          go get -d -v
-          go build -v .
-
-      - name: Run tests
-        run: go test -v ./...
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
new file mode 100644
index 00000000..c45a6eca
--- /dev/null
+++ b/.github/workflows/push.yaml
@@ -0,0 +1,58 @@
+name: push
+on: push
+permissions:
+    contents: read
+    id-token: write
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.15"
+      - run: go test -v -cover $(shell go list ./... | grep -v /vendor)
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.15"
+      - run: CGO_ENABLED=0 GOOS=linux go build -o bin/aws-sigv4-proxy
+      - uses: actions/upload-artifact@v4
+        with:
+          name: bin
+          path: bin/
+  docker-latest:
+    needs:
+      - test
+      - build
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-region: ${{ vars.AWS_REGION }}
+          role-to-assume: ${{ vars.AWS_ECR_IAM_ROLE }}
+      - uses: aws-actions/amazon-ecr-login@v2
+        with:
+          mask-password: "true"
+      - uses: actions/download-artifact@v4
+        with:
+          name: bin
+          path: bin/
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ vars.IMAGE_NAME_DEFAULT }}
+          tags: |
+            type=semver,pattern={{raw}}
+            type=sha,prefix=,format=long,
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          labels: ${{ steps.meta.outputs.labels }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+
diff --git a/Dockerfile b/Dockerfile
index aa689290..0d89657b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM amazonlinux:latest AS build
+FROM amazonlinux:2 AS build
 
 RUN yum -y update && rm -rf /var/cache/yum/*
 RUN yum install -y  \
@@ -7,20 +7,9 @@ RUN yum install -y  \
       bash \
       go
 
-RUN mkdir /aws-sigv4-proxy
-WORKDIR /aws-sigv4-proxy
-COPY go.mod .
-COPY go.sum .
-
-RUN go env -w GOPROXY=direct
-RUN go mod download
-COPY . .
-
-RUN CGO_ENABLED=0 GOOS=linux go build -o /go/bin/aws-sigv4-proxy
-
-FROM alpine:3.7
+FROM alpine:3
 COPY --from=build /etc/ssl/certs/ca-bundle.crt /etc/ssl/certs/
-COPY --from=build /go/bin/aws-sigv4-proxy /go/bin/aws-sigv4-proxy
+COPY --chmod=755 bin/aws-sigv4-proxy /aws-sigv4-proxy
 COPY entrypoint.sh /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/entrypoint.sh b/entrypoint.sh
index 1913e32f..352865f6 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-PROXY_BIN="/go/bin/aws-sigv4-proxy"
+PROXY_BIN="/aws-sigv4-proxy"
 FATE=${FATE:-"standlone"}
 FATE_MOUNT=${FATE_MOUNT:-"/tmp/fate"}
 FATE_FILE=${FATE_FILE:-"${FATE_MOUNT}/main-terminated"}