diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..738d924
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+.github/
+Dockerfile
+justfile
+LICENSE
+README.md
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
new file mode 100644
index 0000000..64c3779
--- /dev/null
+++ b/.github/workflows/docker.yaml
@@ -0,0 +1,40 @@
+---
+name: 'Docker'
+'on':
+  pull_request:
+    branches:
+      - 'master'
+  push:
+    branches:
+      - 'master'
+  schedule:
+    - cron: "0 1 * * 0" # Run every Sunday at 1:00 UTC
+defaults:
+  run:
+    shell: 'bash'
+env:
+  IMAGE_NAME: 'ghcr.io/dsiebel/shellcheck-docker:latest'
+jobs:
+  build:
+    runs-on: 'ubuntu-latest'
+    steps:
+
+      - name: 'Set up Docker Buildx'
+        uses: 'docker/setup-buildx-action@v3'
+
+      - name: 'Build'
+        uses: 'docker/build-push-action@v6'
+        with:
+          push: "${{ github.event_name != 'pull_request' }}"
+          load: "${{ github.event_name == 'pull_request' }}"
+          tags: "${{ env.IMAGE_NAME}}"
+
+      - name: 'Test'
+        run: |
+          docker run --rm --entrypoint shellcheck "${{ env.IMAGE_NAME}}" --version
+
+          docker run --rm \
+            --workdir /usr/local/bin \
+            --env VERBOSE=1 \
+            "${{ env.IMAGE_NAME}}" \
+            --include shellcheckw
diff --git a/Dockerfile b/Dockerfile
index 99e9560..222a5c1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -3,9 +3,12 @@ FROM debian:bookworm-slim
 WORKDIR /usr/src/shellcheck
 
 RUN apt-get update \
+	&& apt-get upgrade --yes \
 	&& apt-get install --yes --no-install-recommends \
 		shellcheck \
-		file
+		file \
+	&& apt-get clean \
+	&& rm -rf /var/lib/apt/lists/*
 
 COPY shellcheckw /usr/local/bin/shellcheckw
 
diff --git a/README.md b/README.md
index a5093db..96d04f4 100644
--- a/README.md
+++ b/README.md
@@ -2,3 +2,11 @@
 
 `debian:bookworm-slim` based Docker image, wrapping [Shellcheck](https://www.shellcheck.net/)
 with some file include / exclude magic.
+
+## Usage
+
+```bash
+docker run --rm --volume $(pwd):/mnt --workdir /mnt \
+	ghcr.io/dsiebel/shellcheck-docker:latest
+	--include-file shellcheck.txt
+```
diff --git a/shellcheckw b/shellcheckw
index d8d0b41..335747f 100755
--- a/shellcheckw
+++ b/shellcheckw
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 [[ -v VERBOSE ]] && set -x
+
+#shellcheck enable=check-set-e-suppressed
 set -eu
+shopt -s inherit_errexit
 
 excludes=()
 includes=()