diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
new file mode 100644
index 0000000..043a524
--- /dev/null
+++ b/.github/workflows/ci.yaml
@@ -0,0 +1,83 @@
+name: CI
+on: push
+jobs:
+  test:
+    strategy:
+      matrix:
+        platform: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v2
+        with:
+          go-version: 1.x
+      - run: make lint
+      - run: make test
+
+  release:
+    runs-on: ubuntu-latest
+    if: contains(github.ref, 'refs/tags/')
+    needs: test
+    outputs:
+      upload_url: ${{ steps.release.outputs.upload_url }}
+    steps:
+      - name: Create GitHub release
+        uses: actions/create-release@v1
+        id: release
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          tag_name: ${{ github.ref }}
+          release_name: ${{ github.ref }}
+          body: TODO
+          draft: true
+
+  assets:
+    strategy:
+      matrix:
+        platform: [ubuntu-latest, windows-latest]
+    runs-on: ${{ matrix.platform }}
+    needs: release
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v2
+        with:
+          go-version: 1.x
+      - run: echo "APP_VERSION=$(git describe --tags --abbrev=0 | sed -e 's/^v//')" >> $GITHUB_ENV
+        shell: bash
+      - run: echo "ASSET_NAME=fastly-exporter-${{ env.APP_VERSION }}.$(go env GOOS)-$(go env GOARCH).tar.gz" >> $GITHUB_ENV
+        shell: bash
+      - run: echo "ASSET_PATH=dist/v${{ env.APP_VERSION }}/${{ env.ASSET_NAME }}" >> $GITHUB_ENV
+        shell: bash
+      - run: make dist
+      - uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ needs.release.outputs.upload_url }}
+          asset_path: ${{ env.ASSET_PATH }}
+          asset_name: ${{ env.ASSET_NAME }}
+          asset_content_type: application/gzip
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: release
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v2
+      - uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v3
+        id: meta
+        with:
+          images: ghcr.io/peterbourgon/fastly-exporter
+      - uses: docker/build-push-action@v2
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
deleted file mode 100644
index 4d37a15..0000000
--- a/.github/workflows/test.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-on: push
-name: Test
-jobs:
-  test:
-    strategy:
-      matrix:
-        platform: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.platform }}
-    steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-go@v2
-        with:
-          go-version: 1.x
-      - name: golint (revive)
-        run: |
-          go install github.com/mgechev/revive@v1.0.9
-          test -z "$(revive ./... 2>&1)"
-      - name: go vet
-        run: go vet ./...
-      - name: staticcheck
-        run: |
-          go install honnef.co/go/tools/cmd/staticcheck@2020.2.1
-          staticcheck ./...
-      - name: gofumpt
-        if: matrix.platform != 'windows-latest' # :(
-        run: |
-          go install mvdan.cc/gofumpt@v0.1.1
-          test -z "$(gofumpt -s -l -d -e . 2>&1)"
-      - name: go test
-        run: go test -race ./...
diff --git a/.gitignore b/.gitignore
index 42c5daa..3f6d4df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,17 +1,4 @@
 /dist/
 /fastly-exporter
-
-# Binaries for programs and plugins
-*.exe
-*.dll
-*.so
-*.dylib
-
-# Test binary, build with `go test -c`
+*.tar.gz
 *.test
-
-# Output of the go coverage tool, specifically when used with LiteIDE
-*.out
-
-# Project-local glide cache, RE: https://github.com/Masterminds/glide/issues/736
-.glide/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..33ae166
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,23 @@
+FROM golang:latest AS builder
+RUN groupadd -r fastly-exporter
+RUN useradd -r -g fastly-exporter fastly-exporter
+WORKDIR /app
+COPY go.mod .
+COPY go.sum .
+RUN go mod download
+ADD .git .git
+ADD cmd cmd
+ADD pkg pkg
+RUN env CGO_ENABLED=0 go build \
+	-a \
+	-ldflags="-X main.programVersion=$(git describe --tags --abbrev=0 | sed -e 's/^v//')" \
+	-o /fastly-exporter \
+	./cmd/fastly-exporter
+
+FROM scratch
+COPY --from=builder /etc/passwd /etc/passwd
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
+COPY --from=builder /fastly-exporter /fastly-exporter
+USER fastly-exporter
+EXPOSE 8080
+ENTRYPOINT ["/fastly-exporter", "-listen=0.0.0.0:8080"]
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..5218dde
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,63 @@
+GO           ?= go
+GOOS         ?= $(shell ${GO} env GOOS)
+GOARCH       ?= $(shell ${GO} env GOARCH)
+VERSION      ?= $(shell git describe --tags --abbrev=0 | sed -e 's/^v//')
+STATICCHECK  ?= $(shell $(GO) env GOPATH)/bin/staticcheck
+REVIVE       ?= $(shell $(GO) env GOPATH)/bin/revive
+GOFUMPT      ?= $(shell $(GO) env GOPATH)/bin/gofumpt
+DOCKER       ?= docker
+BINARY        = fastly-exporter
+BINPKG        = ./cmd/fastly-exporter
+SOURCE        = $(shell find . -name *.go)
+DIST_DIR      = dist/v${VERSION}
+DIST_BIN_FILE = ${BINARY}-${VERSION}.${GOOS}-${GOARCH}
+DIST_ZIP_FILE = ${DIST_BIN_FILE}.tar.gz
+DIST_BIN      = ${DIST_DIR}/${DIST_BIN_FILE}
+DIST_ZIP      = ${DIST_DIR}/${DIST_ZIP_FILE}
+DOCKER_TAG    = fastly-exporter:${VERSION}
+DOCKER_ZIP    = ${DIST_DIR}/${BINARY}-${VERSION}.docker.tar.gz
+
+${BINARY}: ${SOURCE} Makefile
+	env CGO_ENABLED=0 ${GO} build -o ${BINARY} -ldflags="-X main.programVersion=${VERSION}" ${BINPKG}
+
+${DIST_BIN}: ${DIST_DIR} ${SOURCE} Makefile
+	env CGO_ENABLED=0 GOOS=${GOOS} GOARCH=${GOARCH} ${GO} build -o $@ -ldflags="-X main.programVersion=${VERSION}" ${BINPKG}
+
+${DIST_DIR}:
+	mkdir -p $@
+
+${DIST_ZIP}: ${DIST_BIN}
+	tar -C ${DIST_DIR} -c -z -f ${DIST_ZIP} ${DIST_BIN_FILE}
+
+${DOCKER_ZIP}: ${SOURCE} Dockerfile
+	${DOCKER} build --tag=${DOCKER_TAG} .
+	${DOCKER} save --output=$@ ${DOCKER_TAG}
+
+${STATICCHECK}:
+	${GO} install honnef.co/go/tools/cmd/staticcheck@latest
+
+${REVIVE}:
+	${GO} install github.com/mgechev/revive@latest
+
+${GOFUMPT}:
+	${GO} install mvdan.cc/gofumpt@latest
+
+.PHONY: lint
+lint: ${STATICCHECK} ${REVIVE} ${GOFUMPT} ${SOURCE}
+	${GO} vet ./...
+	${STATICCHECK} ./...
+	${REVIVE} ./...
+	${GOFUMPT} -s -l -d -e .
+
+.PHONY: test
+test: ${SOURCE}
+	${GO} test -race ./...
+
+.PHONY: dist
+dist: ${DIST_ZIP}
+
+.PHONY: docker
+docker: ${DOCKER_ZIP}
+
+.PHONY: release
+release: dist docker
diff --git a/README.md b/README.md
index d3dc2f1..41b1ed9 100644
--- a/README.md
+++ b/README.md
@@ -18,21 +18,24 @@ Go to the [releases page][releases].
 
 ### Docker
 
-Avaliable as [mrnetops/fastly-exporter][container] from [Docker Hub][hub].
+Available on the [packages page][pkg] as [peterbourgon/fastly-exporter][img].
 
-[container]: https://hub.docker.com/r/mrnetops/fastly-exporter
-[hub]: https://hub.docker.com
+[pkg]: https://github.com/peterbourgon/fastly-exporter/packages
+[img]: https://github.com/peterbourgon/fastly-exporter/pkgs/container/fastly-exporter
 
+```sh
+docker pull ghcr.io/peterbourgon/fastly-exporter:latest
 ```
-docker pull mrnetops/fastly-exporter
-```
+
+Note that version `latest` will track RCs, alphas, etc. -- always use an
+explicit version in production.
 
 ### Source
 
 If you have a working Go installation, you can clone the repo and install the
 binary from any revision, including HEAD.
 
-```
+```sh
 git clone git@github.com:peterbourgon/fastly-exporter
 cd fastly-exporter
 go build ./cmd/fastly-exporter
@@ -49,7 +52,7 @@ for information on creating API tokens. The token can be provided via the
 
 [token]: https://docs.fastly.com/guides/account-management-and-security/using-api-tokens#creating-api-tokens
 
-```
+```sh
 fastly-exporter -token XXX
 ```
 
@@ -74,7 +77,7 @@ services among different fastly-exporter instances by using the `-service-shard`
 flag. For example, to shard all services between 3 exporters, you would start
 each exporter as
 
-```
+```sh
 fastly-exporter [common flags] -service-shard 1/3
 fastly-exporter [common flags] -service-shard 2/3
 fastly-exporter [common flags] -service-shard 3/3
@@ -102,7 +105,7 @@ export metrics whose names ended in bytes_total, but didn't include imgopto.
 ### Service discovery
 
 Per-service metrics are available via `/metrics?target=<service ID>`. Available
-services are enumerated as targets via the `/sd` endpoint, which is compatible
+services are enumerated as targets on the `/sd` endpoint, which is compatible
 with the [generic HTTP service discovery][httpsd] feature of Prometheus. An
 example Prometheus scrape config for the Fastly exporter follows.
 
@@ -110,7 +113,7 @@ example Prometheus scrape config for the Fastly exporter follows.
 
 ```yaml
 scrape_configs:
-  - job_name: fastly
+  - job_name: fastly-exporter
     http_sd_configs:
       - url: http://127.0.0.1:8080/sd
     relabel_configs:
diff --git a/pkg/prom/registry.go b/pkg/prom/registry.go
index a91becd..d7eafe8 100644
--- a/pkg/prom/registry.go
+++ b/pkg/prom/registry.go
@@ -21,7 +21,7 @@ import (
 //
 // Writers (i.e. rt.Subscribers) should call MetricsFor with their specific
 // service ID, and update the returned set of Prometheus metrics. Readers (i.e.
-// Prometheus) can scrape metrics for all services via the `/metrics` endpoint,
+// Prometheus) can scrape metrics for all services via the `/metrics` endpoint.
 // or a single service via `/metrics?target=<service ID>`.
 //
 // https://prometheus.io/docs/prometheus/latest/configuration/configuration/#http_sd_config
diff --git a/release.fish b/release.fish
deleted file mode 100755
index 8e7355a..0000000
--- a/release.fish
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env fish
-
-function version_prompt
-	echo "Semantic version (e.g. '0.11.9'): "
-end
-
-read --prompt version_prompt VERSION
-
-set VERSION  (echo $VERSION | sed -e 's/^v//')
-set REVISION (git rev-parse --short HEAD)
-echo Tagging $REVISION as v$VERSION
-git tag --annotate v$VERSION -m "Release v$VERSION"
-echo Be sure to: git push --tags
-echo
-
-set DISTDIR dist/v$VERSION
-mkdir -p $DISTDIR
-
-for pair in linux/amd64 darwin/amd64
-	set GOOS   (echo $pair | cut -d'/' -f1)
-	set GOARCH (echo $pair | cut -d'/' -f2)
-	set FNAME  fastly-exporter-$VERSION-$GOOS-$GOARCH
-	set BIN    $DISTDIR/$FNAME
-	set TGZ    $DISTDIR/$FNAME.tar.gz
-	echo $BIN
-	env CGO_ENABLED=0 GOOS=$GOOS GOARCH=$GOARCH go build -o $BIN -ldflags="-X main.programVersion=$VERSION" github.com/peterbourgon/fastly-exporter/cmd/fastly-exporter
-	tar -C $DISTDIR --create --gzip --verbose --file $TGZ $FNAME
-	rm $BIN
-end