diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
new file mode 100644
index 00000000..e95328ea
--- /dev/null
+++ b/.github/workflows/docker-release.yml
@@ -0,0 +1,56 @@
+name: Docker Release
+
+# This workflow was largely generated from the following prompt:
+#   "only run this on merge to main; clone the repo; set the VERSION environment
+#   variable from packages/runtime/package.json; use `docker manifest inspect`
+#   to verify the release doesn't already exist; create a multi-platform builder;
+#   build and push the image"
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get version
+        id: version
+        run: |
+          echo "VERSION=$(cat packages/runtime/package.json | jq -r '.version')" >> "$GITHUB_OUTPUT"
+
+      - name: Check if image already exists
+        id: check
+        run: |
+          if docker manifest inspect ohmjs/ohm:${{ steps.version.outputs.VERSION }} > /dev/null 2>&1; then
+            echo "exists=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "exists=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up QEMU
+        if: steps.check.outputs.exists == 'false'
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        if: steps.check.outputs.exists == 'false'
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to Docker Hub
+        if: steps.check.outputs.exists == 'false'
+        uses: docker/login-action@v4
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        if: steps.check.outputs.exists == 'false'
+        uses: docker/bake-action@v7
+        with:
+          files: docker/docker-compose.yml
+          push: true
+        env:
+          VERSION: ${{ steps.version.outputs.VERSION }}
diff --git a/doc/docker.md b/doc/docker.md
index 27fef28c..d2d9850c 100644
--- a/doc/docker.md
+++ b/doc/docker.md
@@ -132,7 +132,8 @@ export VERSION=$(cat packages/runtime/package.json | jq -r '.version')
 # generate a person access token at https://app.docker.com/accounts/millergarym/settings/personal-access-tokens
 # assuming DHPAT contains your PAT
 echo $DHPAT | docker login -u <personal username> --password-stdin
-docker buildx bake --push
+cd docker
+docker buildx bake --allow=fs.read=.. --push
 ```
 
 `git describe --tag --dirty` produces a version string based on the nearest git tag, appending commit info and a `-dirty` suffix if there are uncommitted changes.
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 17ae868b..22aeda81 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -14,12 +14,11 @@ services:
         - org.opencontainers.image.licenses=MIT
         - org.opencontainers.image.description=Ohm tooling - A library and language for building parsers, interpreters, compilers, etc.
       x-bake:
+        # even thought node:24-slim supports platforms linux/ppc64le & linux/s390x (see https://hub.docker.com/_/node/tags?name=24-slim),
+        # pnpm install fails for there two
         platforms:
           - linux/amd64
-          # - linux/arm/v7
           - linux/arm64/v8
-          # - linux/ppc64le
-          # - linux/s390x
       target: ${TARGET:-dist}
     volumes:
       - .:/local