diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 04d6c53..bc3259d 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -1,16 +1,13 @@
 name: "Build image"
 on: [push]
 
-env: {}
-permissions:
-  packages: write
-
 jobs:
   build-frontend:
     name: Build base frontend image
     runs-on: ubuntu-latest
     outputs:
-      UI_HASH: ${{ steps.git-parse.outputs.PULP_UI_COMMIT }}
+      ui_commit: ${{ steps.git-parse.outputs.PULP_UI_COMMIT }}
+      builder_commit: ${{ steps.git-parse.outputs.SHORT_BUILDER_SHA_COMMIT }}
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -20,6 +17,9 @@ jobs:
         id: git-parse
         run: |
           echo "PULP_UI_COMMIT=$(git -C vendor/pulp-ui rev-parse HEAD)" >> $GITEA_OUTPUT
+          FULL_BUILDER_SHA="${{ gitea.sha }}"
+          SHORT_BUILDER_SHA="${FULL_BUILDER_SHA:0:7}"
+          echo "SHORT_BUILDER_SHA_COMMIT=${SHORT_SHA}" >> $GITEA_OUTPUT
       - name: Setup Docker Buildx
         uses: docker/setup-buildx-action@v3
       - name: Log in to built-in registry
@@ -47,5 +47,41 @@ jobs:
           build-args: |
             PULP_UI_COMMIT=${{ steps.git-parse.outputs.PULP_UI_COMMIT }}
 
+  build-nginx:
+    name: Build nginx image
+    runs-on: ubuntu-latest
+    needs: build-frontend
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          submodules: false  # We're using only Dockerfile.nginx
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to built-in registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ gitea.server_url }}
+          username: pat
+          password: ${{ secrets.IMAGE_PUSH_TOKEN }}
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: code.kruzya.dev/${{ gitea.repository }}/nginx
+          tags: |
+            type=sha,format=short
+            type=raw,value=ui-${{ steps.git-parse.outputs.PULP_UI_COMMIT }}
+      - name: Build nginx image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile.nginx
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          build-args: |
+            BASE_IMG=code.kruzya.dev/CrazyHackGUT/pulp-ui-cri/base-frontend:sha-${{ needs.build-frontend.outputs.builder_commit }}
+
 # TODO: add build nginx image
 
diff --git a/Dockerfile.nginx b/Dockerfile.nginx
new file mode 100644
index 0000000..aa754ad
--- /dev/null
+++ b/Dockerfile.nginx
@@ -0,0 +1,7 @@
+ARG BASE_IMG=code.kruzya.dev/CrazyHackGUT/pulp-ui-cri/base-frontend:latest NGINX_IMG=docker.io/library/nginx:stable
+FROM $BASE_IMG AS frontend
+FROM $NGINX_IMG AS nginx
+
+RUN rm -v /usr/share/nginx/html/*
+COPY --from=frontend /www-root/ /usr/share/nginx/html
+