diff --git a/.github/workflows/manubot.yaml b/.github/workflows/manubot.yaml
index 9a7d5766..0e9329bc 100644
--- a/.github/workflows/manubot.yaml
+++ b/.github/workflows/manubot.yaml
@@ -21,6 +21,26 @@ jobs:
         with:
           # fetch entire commit history to support get_rootstock_commit
           fetch-depth: 0
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Docker login
+        uses: docker/login-action@v1 
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Docker build and push
+        id: docker_build
+        uses: docker/build-push-action@v2
+        with:
+          push: false
+          load: true
+          context: build
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/manubot:latest
+          cache-to: type=inline
+      - name: Show Docker images
+        run: docker images --all
       - name: Set Environment Variables
         run: |
           TRIGGERING_SHA=${GITHUB_PULL_REQUEST_SHA:-$GITHUB_SHA}
@@ -30,6 +50,7 @@ jobs:
           echo "DEFAULT_BRANCH=${DEFAULT_BRANCH}" >> $GITHUB_ENV
           echo "DEFAULT_BRANCH_REF=refs/heads/$DEFAULT_BRANCH" >> $GITHUB_ENV
           echo "DEFAULT_BRANCH=$DEFAULT_BRANCH"
+          echo "IMAGE=ghcr.io/${{ github.repository_owner }}/manubot" >> $GITHUB_ENV
       - name: Cache
         uses: actions/cache@v1
         with:
@@ -37,13 +58,13 @@ jobs:
           key: ci-cache-${{ github.ref }}
           restore-keys: |
             ci-cache-${{ env.DEFAULT_BRANCH_REF }}
-      - name: Install Environment
-        uses: conda-incubator/setup-miniconda@v2
-        with:
-          activate-environment: manubot
-          environment-file: build/environment.yml
-          auto-activate-base: false
-          miniconda-version: 'latest'
+      # - name: Install Environment
+      #   uses: conda-incubator/setup-miniconda@v2
+      #   with:
+      #     activate-environment: manubot
+      #     environment-file: build/environment.yml
+      #     auto-activate-base: false
+      #     miniconda-version: 'latest'
       - name: Install Spellcheck
         shell: bash --login {0}
         run: |
@@ -51,8 +72,12 @@ jobs:
             bash ci/install-spellcheck.sh
           fi
       - name: Build Manuscript
-        shell: bash --login {0}
-        run: bash build/build.sh
+        run: |
+          docker run \
+            --workdir /manuscript \
+            --mount "type=bind,source=$(pwd),target=/manuscript" \
+            $IMAGE \
+            bash build/build.sh
       - name: Upload Artifacts
         uses: actions/upload-artifact@v1
         with:
diff --git a/build/Dockerfile b/build/Dockerfile
new file mode 100644
index 00000000..6459321d
--- /dev/null
+++ b/build/Dockerfile
@@ -0,0 +1,16 @@
+FROM condaforge/miniforge3:latest
+
+ARG CONDA_PREFIX=/opt/conda
+ARG CONDA_ENV=manubot
+
+COPY environment.yml /
+RUN conda env create \
+  --prefix=$CONDA_PREFIX/envs/$CONDA_ENV \
+  --file=/environment.yml \
+  && conda clean --all --force-pkgs-dirs --yes
+
+ENV PATH $CONDA_PREFIX/envs/$CONDA_ENV/bin:$PATH
+RUN echo "source activate $CONDA_ENV" > ~/.bashrc
+RUN /bin/bash -c "source activate $CONDA_ENV"
+
+ENV CONDA_DEFAULT_ENV=$CONDA_ENV
diff --git a/build/environment.yml b/build/environment.yml
index abee7fb1..655d70bf 100644
--- a/build/environment.yml
+++ b/build/environment.yml
@@ -5,6 +5,7 @@ dependencies:
   - cairo=1.14.12
   - cairocffi=0.8.0
   - cffi=1.12.3
+  - gcc_linux-64=9.3.0  # required for pip install pysha3
   - ghp-import=0.5.5
   - jinja2=2.11.2
   - jsonschema=3.2.0
@@ -30,7 +31,7 @@ dependencies:
     - pandoc-tablenos==2.2.2
     - pandoc-xnos==2.4.3
     - pybase62==0.4.3
-    - pysha3==1.0.2
+    - pysha3==1.0.2  # required for opentimestamps
     - python-bitcoinlib==0.10.2
     - requests-cache==0.5.2
     - weasyprint==0.42.3