diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
new file mode 100644
index 000000000..006bed96f
--- /dev/null
+++ b/.github/workflows/docker.yaml
@@ -0,0 +1,34 @@
+name: Docker build
+on:
+  pull_request:
+    types: [labeled]
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.pull_request.labels[0].name == 'docker' }}
+    steps:
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Set up Docker Buildx # must be executed before a step that contains platforms
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: cloud
+          endpoint: "flanksource/node"
+          install: true
+
+      - name: Build
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: flanksource/canary-checker-ui:pr-${{ github.event.pull_request.number }}
+          build-args: |
+            APP_DEPLOYMENT=CANARY_CHECKER
+            WITHOUT_AUTH=true
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 8aca3e15f..983dc045c 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -39,40 +39,6 @@ jobs:
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
-      - name: Set up Docker Buildx # must be executed before a step that contains platforms
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: cloud
-          endpoint: flanksource/node
-
-      - name: Publish canary-checker-ui to Registry
-        uses: elgohr/Publish-Docker-Github-Action@eb53b3ec07136a6ebaed78d8135806da64f7c7e2 # v5
-        env:
-          APP_DEPLOYMENT: CANARY_CHECKER
-          WITHOUT_AUTH: "true"
-        with:
-          name: flanksource/canary-checker-ui
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          buildargs: APP_DEPLOYMENT,WITHOUT_AUTH
-          snapshot: true
-          tags: "latest,v${{ needs.semantic-release.outputs.release-version }}"
-          platforms: linux/amd64,linux/arm64
-
-      - name: Publish incident-manager-ui to Registry
-        uses: elgohr/Publish-Docker-Github-Action@eb53b3ec07136a6ebaed78d8135806da64f7c7e2 # v5
-        env:
-          APP_DEPLOYMENT: "INCIDENT_MANAGER"
-          WITHOUT_AUTH: "false"
-        with:
-          name: flanksource/incident-manager-ui
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-          buildargs: APP_DEPLOYMENT,WITHOUT_AUTH
-          snapshot: true
-          tags: "latest,v${{ needs.semantic-release.outputs.release-version }}"
-          platforms: linux/amd64,linux/arm64
-
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
         with:
@@ -86,6 +52,38 @@ jobs:
         with:
           registry-type: public
 
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Set up Docker Buildx # must be executed before a step that contains platforms
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: cloud
+          endpoint: flanksource/node
+
+      - name: Build & Push Canary Checker UI to Docker Hub
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: flanksource/canary-checker-ui:latest,flanksource/canary-checker-ui:v${{ needs.semantic-release.outputs.release-version }}
+          build-args: |
+            APP_DEPLOYMENT=CANARY_CHECKER
+            WITHOUT_AUTH=true
+
+      - name: Build & Push Incident Manager UI to Docker Hub
+        uses: docker/build-push-action@v6
+        with:
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: flanksource/incident-manager-ui:latest,flanksource/incident-manager-ui:v${{ needs.semantic-release.outputs.release-version }}
+          build-args: |
+            APP_DEPLOYMENT=INCIDENT_MANAGER
+            WITHOUT_AUTH=false
+
       - name: Publish canary-checker-ui to ECR Public
         env:
           REGISTRY: ${{ steps.login-ecr-public.outputs.registry }}
@@ -95,7 +93,7 @@ jobs:
           APP_DEPLOYMENT: CANARY_CHECKER
           WITHOUT_AUTH: "true"
         run: |
-          docker buildx create --use --driver cloud flanksource/node
+          docker buildx create --use
           docker buildx build --platform linux/amd64,linux/arm64 \
             --build-arg APP_DEPLOYMENT \
             --build-arg WITHOUT_AUTH \
@@ -112,7 +110,7 @@ jobs:
           APP_DEPLOYMENT: "INCIDENT_MANAGER"
           WITHOUT_AUTH: "false"
         run: |
-          docker buildx create --use --driver cloud flanksource/node
+          docker buildx create --use
           docker buildx build --platform linux/amd64,linux/arm64 \
             --build-arg APP_DEPLOYMENT \
             --build-arg WITHOUT_AUTH \