diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..14d305c
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,42 @@
+name: Release Firmware
+
+on:
+  push:
+    branches: [main]
+    tags: ['*']
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Build firmware
+        run: docker build -t esp-scope-firmware .
+
+      - name: Extract binary
+        run: docker run --rm esp-scope-firmware cat /workspace/build/esp-scope.bin > esp-scope.bin
+
+      - name: Set release tag
+        id: tag
+        run: |
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            echo "tag=${GITHUB_REF#refs/tags/}" >> "$GITHUB_OUTPUT"
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=latest" >> "$GITHUB_OUTPUT"
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ steps.tag.outputs.tag }}
+          prerelease: ${{ steps.tag.outputs.prerelease }}
+          files: esp-scope.bin
diff --git a/.gitignore b/.gitignore
index 25a0389..09a2f7b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@
 /dependencies.lock
 /.cache
 /.clangd
+*.bin
 
 # Python
 __pycache__/
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..47d704f
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,15 @@
+FROM espressif/idf:v5.5 AS firmware-builder
+SHELL ["/bin/bash", "-c"]
+
+ARG LED_BUILTIN=2
+ARG BSP_CONFIG_GPIO=9
+ARG BOARD_SPECIFIC_INIT="boards/default.h"
+
+COPY CMakeLists.txt dependencies.lock /workspace/
+COPY main /workspace/main
+COPY sdkconfig.defaults /workspace/sdkconfig.defaults
+WORKDIR /workspace
+RUN sed -i "s/^CONFIG_LED_BUILTIN=.*/CONFIG_LED_BUILTIN=${LED_BUILTIN}/" sdkconfig.defaults && \
+    sed -i "s/^CONFIG_BSP_CONFIG_GPIO=.*/CONFIG_BSP_CONFIG_GPIO=${BSP_CONFIG_GPIO}/" sdkconfig.defaults && \
+    sed -i "s|^CONFIG_BOARD_SPECIFIC_INIT=.*|CONFIG_BOARD_SPECIFIC_INIT=\"${BOARD_SPECIFIC_INIT}\"|" sdkconfig.defaults
+RUN source /opt/esp/idf/export.sh > /dev/null 2>&1 && idf.py set-target esp32 && idf.py build
diff --git a/README.md b/README.md
index 2e68940..a9555c6 100644
--- a/README.md
+++ b/README.md
@@ -60,6 +60,43 @@ If you have the esp-idf VSCode extension, just click on the flame to build, flas
    idf.py monitor
    ```
 
+### Building with Docker
+
+If you don't have ESP-IDF installed locally, you can build the firmware using the provided `Dockerfile`.
+
+1. Build the Docker image and firmware:
+   ```bash
+   docker build -t esp-scope-firmware .
+   ```
+   Optionally override board-specific config values:
+   ```bash
+   docker build \
+     --build-arg LED_BUILTIN=8 \
+     --build-arg BSP_CONFIG_GPIO=0 \
+     --build-arg BOARD_SPECIFIC_INIT="boards/xiao-esp32c6.h" \
+     -t esp-scope-firmware .
+   ```
+
+2. Copy the firmware binary out of the image:
+   ```bash
+   docker run --rm esp-scope-firmware cat /workspace/build/esp-scope.bin > esp-scope.bin
+   ```
+
+3. Flash from within Docker (Linux only, requires access to the host USB device):
+   ```bash
+   docker run --rm --device=/dev/ttyUSB0 esp-scope-firmware \
+     bash -c "source /opt/esp/idf/export.sh > /dev/null 2>&1 && \
+              idf.py -p /dev/ttyUSB0 flash"
+   ```
+   Replace `/dev/ttyUSB0` with your serial port. On macOS/Windows, flashing from inside Docker is not supported due to USB passthrough limitations — copy the binary out and flash with `esptool.py` directly.
+
+4. Monitor serial output from within Docker:
+   ```bash
+   docker run --rm -it --device=/dev/ttyUSB0 esp-scope-firmware \
+     bash -c "source /opt/esp/idf/export.sh > /dev/null 2>&1 && \
+              idf.py monitor"
+   ```
+
 ### Using the esp-scope
 
 If your DHCP server supports it (most seem to), the app sets its hostname and you can just navigate to http://esp-scope (you may have/need a default domain extension)