diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5ace460
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..1899ff7
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,21 @@
+name: "Test"
+on:
+  repository_dispatch:
+  workflow_dispatch:
+  schedule:
+    - cron:  '51 2 * * 0'
+jobs:
+  strategy:
+    matrix:
+      tag:
+        - nixos-21.05
+        - nixos-unstable
+  images:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - uses: cachix/install-nix-action@v13
+      with:
+        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/nixpkgs-unstable.tar.gz
+    - name: Build image
+      run: ./build-images.sh "${{matrix.tag}}"
diff --git a/README.md b/README.md
index 0f82f6d..e00e90f 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,3 @@
-# nixos-images
\ No newline at end of file
+# nixos-images
+
+Automatically build (netboot) images for NixOS.
diff --git a/build-images.sh b/build-images.sh
new file mode 100755
index 0000000..804994f
--- /dev/null
+++ b/build-images.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p nix -p coreutils -p bash -p gh -i bash
+set -xeuo pipefail
+
+build_netboot_image() {
+  tag=$1
+  arch=$2
+  img=$(nix-build --no-out-link -I "nixpkgs=https://github.com/NixOS/nixpkgs/archive/${tag}.tar.gz" '<nixpkgs/nixos/release.nix>' -A "netboot.$arch")
+  echo $(readlink "$img/bzImage")
+  echo $(readlink "$img/initrd")
+}
+
+main() {
+  tag=${1:-nixos-unstable}
+  arch=${2:-x86_64-linux}
+  sha256s=()
+  tmp="$(mktemp -d)"
+  trap 'rm -rf -- "$tmp"' EXIT
+  assets=($(build_netboot_image "$tag" "$arch"))
+
+  for asset in "${assets[@]}"; do
+    pushd "$(dirname $asset)"
+    sha256sum "$(basename $asset)" > "$TMP/sha256sums"
+    popd
+  done
+  assets+=("$TMP/sha256sums")
+
+  # Since we cannot atomically update a release, we delete the old one before
+  gh release delete "$tag" </dev/null || true
+  gh release create --title "$tag (build $(date +"%Y-%m-%d"))" "$tag" "${assets[@]}" </dev/null
+}
+
+main "$@"