diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..038672e
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,2 @@
+/bin
+/release
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..fd111c7
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,43 @@
+name: build
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - 'master'
+    tags:
+      - 'v*'
+  pull_request:
+
+env:
+  DESTDIR: ./bin
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      -
+        name: Build
+        uses: docker/bake-action@v2
+        with:
+          targets: binaries
+      -
+        name: Move artifacts
+        run: |
+          mv ${{ env.DESTDIR }}/**/* ${{ env.DESTDIR }}/
+      -
+        name: Upload artifacts
+        uses: actions/upload-artifact@v3
+        with:
+          name: docker-credential-helpers
+          path: ${{ env.DESTDIR }}/*
+          if-no-files-found: error
diff --git a/.gitignore b/.gitignore
index c0f3701..038672e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-bin
-release
+/bin
+/release
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..2f6d503
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,80 @@
+# syntax=docker/dockerfile:1
+
+ARG GO_VERSION=1.16.7
+ARG XX_VERSION=1.1.2
+ARG OSXCROSS_VERSION=11.3-r7-alpine
+
+ARG PKG=github.com/docker/docker-credential-helpers
+
+# xx is a helper for cross-compilation
+FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
+
+# osxcross contains the MacOSX cross toolchain for xx
+FROM crazymax/osxcross:${OSXCROSS_VERSION} AS osxcross
+
+FROM --platform=$BUILDPLATFORM golang:${GO_VERSION}-alpine AS gobase
+COPY --from=xx / /
+RUN apk add --no-cache clang file git lld llvm pkgconf
+ENV GOFLAGS="-mod=vendor"
+ENV CGO_ENABLED="1"
+WORKDIR /src
+
+FROM gobase AS version
+ARG PKG
+RUN --mount=target=. \
+    VERSION=$(git describe --match 'v[0-9]*' --dirty='.m' --always --tags); \
+    echo "-s -w -X ${PKG}/credentials.Version=${VERSION}" | tee /tmp/.ldflags; \
+    echo -n "${VERSION}" | tee /tmp/.version;
+
+FROM gobase AS base
+ARG TARGETPLATFORM
+RUN xx-apk add musl-dev gcc libsecret-dev pass
+
+FROM base AS build-linux
+ARG TARGETOS
+ARG TARGETARCH
+ARG TARGETVARIANT
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=bind,from=version,source=/tmp/.ldflags,target=/tmp/.ldflags <<EOT
+  set -ex
+  mkdir /out
+  xx-go build -ldflags "$(cat /tmp/.ldflags)" -o /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} ./pass/cmd/main.go
+  xx-verify /out/docker-credential-pass-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
+  xx-go build -ldflags "$(cat /tmp/.ldflags)" -o /out/docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} ./secretservice/cmd/main_linux.go
+  xx-verify /out/docker-credential-secretservice-${TARGETOS}-${TARGETARCH}${TARGETVARIANT}
+EOT
+
+FROM base AS build-darwin
+ARG TARGETARCH
+ARG TARGETVARIANT
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=bind,from=osxcross,src=/osxsdk,target=/xx-sdk \
+    --mount=type=bind,from=version,source=/tmp/.ldflags,target=/tmp/.ldflags <<EOT
+  set -ex
+  mkdir /out
+  xx-go install std
+  xx-go build -ldflags "$(cat /tmp/.ldflags)" -o /out/docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT} ./osxkeychain/cmd/main_darwin.go
+  xx-verify /out/docker-credential-osxkeychain-${TARGETARCH}${TARGETVARIANT}
+EOT
+
+FROM base AS build-windows
+ARG TARGETARCH
+ARG TARGETVARIANT
+RUN --mount=type=bind,target=. \
+    --mount=type=cache,target=/root/.cache \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=bind,from=version,source=/tmp/.ldflags,target=/tmp/.ldflags <<EOT
+  set -ex
+  mkdir /out
+  xx-go build -ldflags "$(cat /tmp/.ldflags)" -o /out/docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe ./wincred/cmd/main_windows.go
+  xx-verify /out/docker-credential-wincred-${TARGETARCH}${TARGETVARIANT}.exe
+EOT
+
+FROM build-$TARGETOS AS build
+
+FROM scratch AS binaries
+COPY --from=build /out /
diff --git a/Jenkinsfile b/Jenkinsfile
deleted file mode 100644
index e43d232..0000000
--- a/Jenkinsfile
+++ /dev/null
@@ -1,83 +0,0 @@
-pipeline {
-    agent none
-    options {
-        checkoutToSubdirectory('src/github.com/docker/docker-credential-helpers')
-    }
-    stages {
-        stage('build') {
-            parallel {
-                stage('linux') {
-                    agent {
-                        kubernetes {
-                            label 'declarative'
-                            containerTemplate {
-                                name 'golang'
-                                image 'golang:1.12.4'
-                                ttyEnabled true
-                                command 'cat'
-                            }
-                        }
-                    }
-                    environment {
-                        GOPATH = pwd()
-                        PATH   = "/usr/local/go/bin:${GOPATH}/bin:$PATH"
-                    }
-                    steps {
-                        container('golang') {
-                            dir('src/github.com/docker/docker-credential-helpers') {
-                                sh 'apt-get update && apt-get install -y libsecret-1-dev pass'
-                                sh 'make deps fmt lint test'
-                                sh 'make pass secretservice'
-                                sh 'make linuxrelease'
-                                archiveArtifacts 'release/docker-credential-*'
-                            }
-                        }
-                    }
-                }
-                stage('mac') {
-                    agent {
-                        label 'mac-build && go1.12.4'
-                    }
-                    environment {
-                        PATH   = "/usr/local/go/bin:${GOPATH}/bin:$PATH"
-                        GOPATH = pwd()
-                    }
-                    steps {
-                        dir('src/github.com/docker/docker-credential-helpers') {
-                            sh 'make deps fmt lint test'
-                            sh 'make osxcodesign'
-                            sh 'make osxrelease'
-                            archiveArtifacts 'release/docker-credential-*'
-                        }
-                    }
-                }
-                stage('windows') {
-                    agent {
-                        label 'win-build && go1.12.4'
-                    }
-                    environment {
-                        GOPATH      = pwd()
-                        PATH        = "${pwd()}/bin;$PATH"
-                        PFX         = credentials('windows-build-2019-pfx')
-                        PFXPASSWORD = credentials('windows-build-2019-pfx-password')
-                    }
-                    steps {
-                        dir('src/github.com/docker/docker-credential-helpers') {
-                            sh 'echo ${PFX} | base64 -d > pfx'
-
-                            sh 'make deps fmt lint test'
-                            sh 'make wincred'
-                            bat """ "C:\\Program Files (x86)\\Windows Kits\\10\\bin\\x86\\signtool.exe" sign /fd SHA256 /a /f pfx /p ${PFXPASSWORD} /d Docker /du https://www.docker.com /t http://timestamp.verisign.com/scripts/timestamp.dll bin\\docker-credential-wincred.exe """
-                            archiveArtifacts 'bin/docker-credential-*'
-                        }
-                    }
-                    post {
-                        always {
-                            sh 'rm -f pfx'
-                        }
-                    }
-                }
-            }
-        }
-    }
-}
diff --git a/docker-bake.hcl b/docker-bake.hcl
new file mode 100644
index 0000000..bb1b5b8
--- /dev/null
+++ b/docker-bake.hcl
@@ -0,0 +1,31 @@
+variable "GO_VERSION" {
+  default = "1.16.7"
+}
+variable "DESTDIR" {
+  default = "./bin"
+}
+
+target "_common" {
+  args = {
+    GO_VERSION = GO_VERSION
+  }
+}
+
+group "default" {
+  targets = ["binaries"]
+}
+
+target "binaries" {
+  inherits = ["_common"]
+  target = "binaries"
+  output = [DESTDIR]
+  platforms = [
+    "darwin/amd64",
+    "darwin/arm64",
+    "linux/amd64",
+    "linux/arm64",
+    "linux/arm/v7",
+    "linux/arm/v6",
+    "windows/amd64"
+  ]
+}