diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 00000000000..b80ea44d41a
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,57 @@
+# NOTE: This name appears in GitHub's Checks API and in workflow's status badge.
+name: docker
+
+# Trigger the workflow when:
+on:
+  # A push occurs to one of the matched branches.
+  push:
+    branches:
+      - master
+      - stable/*
+    paths:
+      - docker/**
+  # XXX: Remove section below, this is only for testing.
+  pull_request:
+    branches:
+      - master
+      - stable/*
+    paths:
+      - docker/**
+
+jobs:
+
+  build-images:
+    # NOTE: This name appears in GitHub's Checks API.
+    name: build-images
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+      - name: Determine tag name
+        id: determine_tag
+        shell: bash
+        run: |
+          branch=${GITHUB_REF#refs/heads/}
+          branch=${branch/\//-}
+          echo "##[set-output name=tag;]$(echo ${branch})"
+      - name: "Rebuild oasisprotocol/oasis-core-dev:${{ steps.determine_tag.outputs.tag }}"
+        uses: docker/build-push-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
+          repository: oasisprotocol/oasis-core-dev
+          tags: ${{ steps.determine_tag.outputs.tag }}
+          add_git_labels: true
+          path: docker/development
+          always_pull: true
+      - name: "Rebuild oasisprotocol/oasis-core-ci:${{ steps.determine_tag.outputs.tag }}"
+        uses: docker/build-push-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_ACCESS_TOKEN }}
+          repository: oasisprotocol/oasis-core-ci
+          tags: ${{ steps.determine_tag.outputs.tag }}
+          add_git_labels: true
+          path: docker/testing
+          build_args: OASIS_CORE_DEV_BASE_TAG=${{ steps.determine_tag.outputs.tag }}
+          always_pull: true
diff --git a/docker/testing/Dockerfile b/docker/testing/Dockerfile
index c4de2e41c1d..c78a963e0d6 100644
--- a/docker/testing/Dockerfile
+++ b/docker/testing/Dockerfile
@@ -1,4 +1,6 @@
-FROM oasislabs/development:0.3.0
+ARG OASIS_CORE_DEV_BASE_TAG=master
+
+FROM oasisprotocol/oasis-core-dev:${OASIS_CORE_DEV_BASE_TAG}
 
 RUN apt-get install -y \
     unzip jq \