diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index 66c4caa1..00000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,99 +0,0 @@
-version: 2
-
-setup: &setup
-  working_directory: ~/snow-today-webapp-server
-
-jobs:
-  test:
-    <<: *setup
-    docker:
-      - image: mambaorg/micromamba:1.0
-    steps:
-      - checkout
-      - restore_cache:
-          key: 'conda-{{ checksum "environment-lock.yml" }}'
-      - run:
-          name: 'Setup conda environment'
-          command: |
-            if [ -d '/opt/conda/lib' ]; then
-              echo 'Environment restored from cache. Skipping setup!'
-              exit 0
-            fi
-
-            cp environment-lock.yml environment-ci.yml
-            micromamba install -y -p /opt/conda -f environment-ci.yml
-      - save_cache:
-          key: 'conda-{{ checksum "environment-lock.yml" }}'
-          paths: '/opt/conda'
-      - run:
-          name: 'Static analysis'
-          command: |
-            micromamba run inv test.static
-
-
-  build-docker-images-and-sometimes-publish:
-    <<: *setup
-    docker:
-      - image: docker:20.10.3-git
-    steps:
-      - checkout
-      # `setup_remote_docker` defaults to 17.09.0 which doesn't work with the
-      # node image we're trying to build...
-      #   https://support.circleci.com/hc/en-us/articles/360050934711
-      #   https://discuss.circleci.com/t/docker-build-fails-with-nonsensical-eperm-operation-not-permitted-copyfile/37364
-      - setup_remote_docker:
-          version: 20.10.2
-      - run:
-          name: Build and push Docker image
-          command: |
-            for IMAGE_NAME in "nsidc/snow-today-webapp-server" "nsidc/snow-today-webapp-server-ingest"; do
-              echo "\$CIRCLE_TAG: ${CIRCLE_TAG}"
-              echo "\$CIRCLE_BRANCH: ${CIRCLE_BRANCH}"
-
-              if [[ "${CIRCLE_TAG}" ]]; then
-                TAG="${CIRCLE_TAG}"
-              elif [[ "${CIRCLE_BRANCH}" = "main" ]]; then
-                TAG="latest"
-              else
-                # We don't really want images named after tags cluttering up our
-                # DH repo, so we use workflow filters to prevent this job from
-                # being triggered on a branch. Change the filters if we change
-                # our mind.
-                TAG="${CIRCLE_BRANCH}"
-              fi
-              echo "\$TAG: ${TAG}"
-
-
-              if [[ "${IMAGE_NAME}" = "nsidc/snow-today-webapp-server-ingest" ]]; then
-                DOCKERFILE="Dockerfile.ingest"
-              else
-                DOCKERFILE="Dockerfile"
-              fi
-              DOCKER_IMAGE="${IMAGE_NAME}:${TAG}"
-              docker build -f "${DOCKERFILE}" -t "${DOCKER_IMAGE}" .
-              echo "Built: ${DOCKER_IMAGE}"
-
-              docker login -u "${DOCKER_USER}" -p "${DOCKER_PASS}"
-              docker push "${DOCKER_IMAGE}"
-            done
-
-
-workflows:
-  version: 2
-
-  build:
-    jobs:
-      - test:
-          filters:
-            tags:
-              only: /.*/
-
-      - build-docker-images-and-sometimes-publish:
-          context: org-global
-          requires:
-            - test
-          filters:
-            branches:
-              only: main
-            tags:
-              only: /^v[0-9]+(\.[0-9]+)*(\.[\-a-zA-Z0-9]+)?$/
diff --git a/.github/workflows/container_image.yml b/.github/workflows/container_image.yml
new file mode 100644
index 00000000..0567b8b6
--- /dev/null
+++ b/.github/workflows/container_image.yml
@@ -0,0 +1,30 @@
+name: "Docker container image"
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+
+
+jobs:
+  # When a push to the default branch occurs, build and release "latest" images
+  # When a tag `vX.Y.Z` push occurs, build and release images with that tag
+
+  build-and-release-image:
+    name: "Build and release the data server container image"
+    needs:
+      - "test"
+    uses: "nsidc/.github/.github/workflows/build-and-publish-container-image.yml@main"
+    secrets: "inherit"
+
+  # TODO: Decouple the two images
+  build-and-release-ingest-image:
+    name: "Build and release the ingest container image"
+    needs:
+      - "build-and-release-image"
+    uses: "nsidc/.github/.github/workflows/build-and-publish-container-image.yml@main"
+    secrets: "inherit"
+    with:
+      docker-file-name: "Dockerfile.ingest"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 00000000..384631a5
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,37 @@
+name: "Test"
+
+on:
+  push:
+    branches:
+      - "main"
+  pull_request:
+
+
+# Default to bash in login mode; key to activating conda environment
+# https://github.com/mamba-org/provision-with-micromamba#IMPORTANT
+defaults:
+  run:
+    shell: "bash -l {0}"
+
+
+jobs:
+  test:
+    name: "Run tests"
+    runs-on: "ubuntu-latest"
+    steps:
+      - name: "Check out repository"
+        uses: "actions/checkout@v3"
+
+      - name: "Install Conda environment"
+        uses: "mamba-org/setup-micromamba@v1"
+        with:
+          environment-file: "conda-lock.yml"
+          # When using a lock-file, we have to set an environment name.
+          environment-name: "ci"
+          cache-environment: true
+          # Increase this key to trigger cache invalidation
+          cache-environment-key: 0
+
+      - name: "Run tests"
+        # TODO: Nox instead!
+        run: "inv test"