diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b200904..bed718f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -19,6 +19,7 @@ on:
 
 permissions:
   contents: write
+  packages: write
   pages: write
   id-token: write
 
@@ -45,17 +46,26 @@ jobs:
           python -m pip install --upgrade pip
           pip install -r requirements_ci.txt
 
-      - name: Train demo model and build static site
+      - name: Log in to GitHub Container Registry (GHCR)
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set image name
+        id: set-image
         run: |
-          python simple_demo.py
-          python generate_site.py
+          # create lowercase owner name (GHCR requires lowercase owner/org)
+          owner_lower=$(echo "${{ github.repository_owner }}" | tr '[:upper:]' '[:lower:]')
+          image_latest="ghcr.io/${owner_lower}/mindguard:latest"
+          image_sha="ghcr.io/${owner_lower}/mindguard:${GITHUB_SHA}"
+          echo "image_latest=$image_latest" >> $GITHUB_OUTPUT
+          echo "image_sha=$image_sha" >> $GITHUB_OUTPUT
 
-      - name: Deploy site to gh-pages branch
-        uses: peaceiris/actions-gh-pages@v3
+      - name: Build and push Docker image (runs app.py)
+        uses: docker/build-push-action@v4
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          publish_dir: ./docs
-          publish_branch: gh-pages
-          # keep repository history small by not committing other files
-          user_name: github-actions[bot]
-          user_email: github-actions[bot]@users.noreply.github.com
+          context: .
+          push: true
+          tags: ${{ steps.set-image.outputs.image_latest }},${{ steps.set-image.outputs.image_sha }}