diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..4e8e7f9
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+ci/
+README.md
diff --git a/Dockerfile b/Dockerfile
index 020ccfb..da97c4c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,9 +1,7 @@
 FROM alpine:latest
 
-RUN apk add \
-        curl \
-        certbot \
-        openssl
+RUN apk add --no-cache --upgrade \
+        curl certbot openssl
 
 RUN mkdir -p /etc/periodic/12h \
     && mkdir -p /etc/periodic/5min
diff --git a/readme.md b/README.md
similarity index 100%
rename from readme.md
rename to README.md
diff --git a/arch.txt b/arch.txt
deleted file mode 100644
index 2a6787b..0000000
--- a/arch.txt
+++ /dev/null
@@ -1,35 +0,0 @@
-aarch64
-# aarch64_be
-# alpha
-arm
-# armeb
-# cris
-# hppa
-i386
-# m68k
-# microblaze
-# microblazeel
-# mips
-# mips64
-# mips64el
-# mipsel
-# mipsn32
-# mipsn32el
-# nios2
-# or1k
-# ppc
-# ppc64
-# ppc64abi32
-ppc64le
-# riscv32
-# riscv64
-s390x
-# sh4
-# sh4eb
-# sparc
-# sparc32plus
-# sparc64
-# tilegx
-x86_64
-# xtensa
-# xtensaeb
diff --git a/build.sh b/build.sh
deleted file mode 100755
index 8f9c610..0000000
--- a/build.sh
+++ /dev/null
@@ -1,30 +0,0 @@
-#!/usr/bin/env sh
-
-platforms() {
-    plat="$(grep '^[^#].*' < arch.txt)"
-    arch_count="$(echo "$plat" | wc -l)"
-    echo "$plat" | tr '\n' ',' | cut -d, -f1-$arch_count
-}
-
-create() {
-    docker buildx create --use
-}
-
-build() {
-    tagname="$1"
-    docker pull 'alpine:latest'
-    docker buildx build --push --tag="$tagname" --platform="$(platforms)" .
-}
-
-get_tag() {
-    git rev-parse --short HEAD
-}
-
-deploy() {
-    tag0="redxef/certbot-duckdns:$(get_tag)"
-    tag1="redxef/certbot-duckdns:latest"
-    build "$tag0"
-    build "$tag1"
-}
-
-"$@"
diff --git a/ci/pipeline.yml b/ci/pipeline.yml
new file mode 100644
index 0000000..947f5fb
--- /dev/null
+++ b/ci/pipeline.yml
@@ -0,0 +1,66 @@
+---
+resources:
+- name: source
+  type: git
+  source:
+    uri: https://gitea.redxef.at/redxef/certbot-duckdns
+    branch: master
+    fetch_tags: true
+- name: upstream-image
+  type: registry-image
+  source:
+    repository: alpine
+
+jobs:
+- name: build-push
+  plan:
+  - get: source
+    trigger: true
+  - get: upstream-image
+    trigger: true
+  - task: compute-docker-tags
+    config:
+      platform: linux
+      image_resource:
+        type: registry-image
+        source:
+          repository: alpine/git
+      inputs:
+      - name: source
+        path: .
+      outputs:
+      - name: docker-tags
+      run:
+        path: sh
+        args:
+        - -c
+        - |
+          #!/usr/bin/env sh
+          git rev-parse --short HEAD > docker-tags/tags.txt
+          git show-ref --tags | \
+              sed -n "/$(git rev-parse HEAD)/ s|$(git rev-parse HEAD).refs/tags/||gp" \
+              >> docker-tags/tags.txt
+  - task: build
+    privileged: true
+    config:
+      platform: linux
+      image_resource:
+        type: registry-image
+        source:
+          repository: redxef/concourse-buildkit
+      inputs:
+      - name: source
+        path: .
+      - name: docker-tags
+      params:
+        username: ((docker.username))
+        password: ((docker.password))
+        repository: docker.io/redxef/certbot-duckdns
+        tag: latest
+        additional_tags: docker-tags/tags.txt
+        push: true
+        platform: aarch64,arm,i386,ppc64le,s390x,x86_64
+        context: .
+        manual: false
+      run:
+        path: build