diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
new file mode 100644
index 0000000..62e7aaf
--- /dev/null
+++ b/.github/workflows/docker-build.yml
@@ -0,0 +1,85 @@
+name: Docker Build
+
+on:
+  push:
+    branches:
+      - "**"
+    tags:
+      - "v*"
+    paths:
+      - ".github/workflows/**"
+  workflow_dispatch:
+
+env:
+  REGISTRY: docker.pchuan.top
+  IMAGE_NAME: pyxray
+  APT_MIRROR: https://mirrors.ustc.edu.cn/debian
+  UV_INDEX_URL: https://pypi.mirrors.ustc.edu.cn/simple/
+
+jobs:
+  docker-build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Read project version
+        id: version
+        shell: bash
+        run: |
+          version="$(python - <<'PY'
+          import tomllib
+
+          with open("pyproject.toml", "rb") as f:
+              print(tomllib.load(f)["project"]["version"])
+          PY
+          )"
+
+          echo "version=${version}" >> "$GITHUB_OUTPUT"
+          echo "image=${REGISTRY}/${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
+
+      - name: Validate git tag version
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        env:
+          PROJECT_VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          tag="${GITHUB_REF_NAME}"
+          expected="v${PROJECT_VERSION}"
+
+          if [ "$tag" != "$expected" ]; then
+            echo "Git tag '${tag}' does not match pyproject.toml version '${PROJECT_VERSION}'. Expected '${expected}'."
+            exit 1
+          fi
+
+      - name: Build Docker image
+        shell: bash
+        env:
+          IMAGE: ${{ steps.version.outputs.image }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          docker build \
+            --build-arg "APT_MIRROR=${APT_MIRROR}" \
+            --build-arg "UV_INDEX_URL=${UV_INDEX_URL}" \
+            -t "${IMAGE}:latest" \
+            -t "${IMAGE}:${VERSION}" \
+            .
+
+      - name: Login Docker registry
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        run: |
+          echo "${{ secrets.REGISTRY_PASSWORD }}" | docker login "${REGISTRY}" \
+            -u "${{ secrets.REGISTRY_USERNAME }}" \
+            --password-stdin
+
+      - name: Push Docker image
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: bash
+        env:
+          IMAGE: ${{ steps.version.outputs.image }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          docker push "${IMAGE}:latest"
+          docker push "${IMAGE}:${VERSION}"
diff --git a/scripts/build.sh b/scripts/build.sh
index d283dd7..c611d93 100644
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -5,14 +5,25 @@ SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
 PROJECT_DIR=$(CDPATH= cd -- "$SCRIPT_DIR/.." && pwd)
 
 IMAGE_NAME=${IMAGE_NAME:-pyxray}
-IMAGE_TAG=${IMAGE_TAG:-latest}
 APT_MIRROR=${APT_MIRROR:-https://mirrors.ustc.edu.cn/debian}
 UV_INDEX_URL=${UV_INDEX_URL:-https://pypi.mirrors.ustc.edu.cn/simple/}
 
 cd "$PROJECT_DIR"
 
+PYTHON_BIN=${PYTHON_BIN:-}
+if [ -z "$PYTHON_BIN" ]; then
+  if command -v python3 >/dev/null 2>&1; then
+    PYTHON_BIN=python3
+  else
+    PYTHON_BIN=python
+  fi
+fi
+
+IMAGE_VERSION=${IMAGE_VERSION:-$("$PYTHON_BIN" -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')}
+
 docker build \
   --build-arg "APT_MIRROR=$APT_MIRROR" \
   --build-arg "UV_INDEX_URL=$UV_INDEX_URL" \
-  -t "$IMAGE_NAME:$IMAGE_TAG" \
+  -t "$IMAGE_NAME:latest" \
+  -t "$IMAGE_NAME:$IMAGE_VERSION" \
   .