diff --git a/.github/workflows/build-docker.yml b/.github/workflows/build-docker.yml
new file mode 100644
index 00000000..a89bd0f6
--- /dev/null
+++ b/.github/workflows/build-docker.yml
@@ -0,0 +1,49 @@
+---
+name: Docker Build and Push
+
+on: 
+  workflow_call:
+    inputs:
+      org:
+        default: freezingsaddles
+        description: 'Docker Hub organization'
+        required: false
+        type: string
+      repo:
+        default: freezing-web
+        description: 'Docker Hub repository name'
+        required: false
+        type: string
+      tag:
+        default: latest
+        description: 'tag for Docker container'
+        required: false
+        type: string
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: true
+      DOCKERHUB_TOKEN:
+        required: true
+
+jobs:
+  docker:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      -
+        name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          push: true
+          tags: ${{ inputs.org }}/${{ inputs.repo }}:${{ inputs.tag }}
diff --git a/.github/workflows/build-latest.yml b/.github/workflows/build-latest.yml
new file mode 100644
index 00000000..c1077d15
--- /dev/null
+++ b/.github/workflows/build-latest.yml
@@ -0,0 +1,47 @@
+---
+name: Build Deploy and Test Latest
+
+on:
+  push:
+    branches:
+      - 'master'
+
+jobs:
+
+  docker:
+    uses: freezingsaddles/freezing-web/.github/workflows/build-docker.yml@1.4.16
+    with:
+      tag: latest
+    secrets: inherit
+
+  deploy-and-test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+
+    - name: install
+      uses: appleboy/ssh-action@v1.1.0
+      with:
+        host: ${{ secrets.HOST }}
+        username: ${{ secrets.USERNAME }}
+        key: ${{ secrets.KEY }}
+        port: ${{ secrets.PORT }}
+        passphrase: ${{ secrets.PASSPHRASE }}
+        script: |
+          set -euo pipefail
+          cd /opt/compose
+          docker-compose pull freezing-web
+          docker-compose up -d freezing-web
+
+    - name: wait
+      uses: iFaxity/wait-on-action@v1.2.1
+      with:
+        resource: https-get://freezingsaddles.org
+        timeout: 5000
+
+    - name: checkout
+      uses: actions/checkout@v4
+
+    - name: test-wget-spider
+      run: "URL=https://freezingsaddles.org test/wget-spider.sh"
+
diff --git a/.github/workflows/build-tag.yml b/.github/workflows/build-tag.yml
new file mode 100644
index 00000000..d7ab1f8b
--- /dev/null
+++ b/.github/workflows/build-tag.yml
@@ -0,0 +1,14 @@
+---
+name: Build Tag
+
+on:
+  push:
+    tags:
+      - '*' 
+
+jobs:
+  docker:
+    uses: freezingsaddles/freezing-web/.github/workflows/build-docker.yml@1.4.16
+    with:
+      tag: ${{ github.ref_name }}
+    secrets: inherit
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000..7d6f2818
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,11 @@
+---
+name: Build
+
+on: pull_request
+
+jobs:
+  docker:
+    uses: freezingsaddles/freezing-web/.github/workflows/build-docker.yml@1.4.16
+    with:
+      tag: latest-actions-build
+    secrets: inherit
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 000d56ba..51398ac8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,7 +1,7 @@
 ---
 name: Lint
 
-on: [push, pull_request]
+on: pull_request
 
 jobs:
   
@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out source repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Set up Python environment
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@v5
         with:
           python-version: "3.10"
       - name: black Lint
diff --git a/Dockerfile b/Dockerfile
index 12795220..8aca33a2 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -12,4 +12,4 @@ WORKDIR /app
 ENV LEADERBOARDS_DIR=/data/leaderboards
 USER freezing
 EXPOSE 8000
-ENTRYPOINT gunicorn --bind 0.0.0.0:8000 'freezing.web:app'
+ENTRYPOINT ["gunicorn", "--bind", "0.0.0.0:8000", "freezing.web:app"]