diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 0000000..e2c1a4a
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,273 @@
+
+name: Docker images
+
+# WARNING: generated file, use update.py for updates
+
+on: [push, pull_request]
+
+jobs:
+
+
+  image-openjdk8:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk8
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk8-with-ant-gcc:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk8-with-ant-gcc
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk9:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk9
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk10:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk10
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk11:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk11
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk11-with-ant-gcc:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk11-with-ant-gcc
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk12:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk12
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk13:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk13
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk14:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk14
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk15:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk15
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk16:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk16
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk17:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk17
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk18:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk18
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk19:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk19
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk20:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk20
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk21:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk21
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk22:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk22
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openjdk23-ea:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openjdk23-ea
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openj9-openjdk8:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openj9-openjdk8
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openj9-openjdk11:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openj9-openjdk11
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openj9-openjdk17:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openj9-openjdk17
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
+
+  image-openj9-openjdk21:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: openj9-openjdk21
+      push: ${{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}
+
+
diff --git a/.github/workflows/lib-build-image.yml b/.github/workflows/lib-build-image.yml
new file mode 100644
index 0000000..b8dfc9f
--- /dev/null
+++ b/.github/workflows/lib-build-image.yml
@@ -0,0 +1,39 @@
+
+name: _ Image building helpers
+
+on:
+  workflow_call:
+    inputs:
+      name:
+        required: true
+        type: string
+      push:
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Load configuration and versions
+        run: cat version.rc >> "$GITHUB_ENV"
+
+      - name: Log into image registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push the Docker image
+        id: build-and-push
+        uses: docker/build-push-action@v5
+        with:
+          context: "{{defaultContext}}:buildenv-${{ inputs.name }}"
+          push: ${{ inputs.push }}
+          tags: "${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_REGISTRY_NAMESPACE }}/${{ env.DOCKER_IMAGE_NAME }}:${{ env.DOCKER_IMAGE_VERSION_TAG }}-${{ inputs.name }}"
diff --git a/.github/workflows/tags.yml b/.github/workflows/tags.yml
new file mode 100644
index 0000000..07796a6
--- /dev/null
+++ b/.github/workflows/tags.yml
@@ -0,0 +1,20 @@
+name: Check tag synchronization
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Git checkout
+        uses: actions/checkout@v2
+
+      - name: Load configuration and versions
+        run: cat version.rc >> "$GITHUB_ENV"
+
+      - name: Check tag name corresponds to DOCKER_IMAGE_VERSION_TAG
+        shell: bash
+        run: test "refs/tags/$DOCKER_IMAGE_VERSION_TAG" = "${{ github.ref }}"
diff --git a/update.py b/update.py
index 150ca9a..f997ea0 100755
--- a/update.py
+++ b/update.py
@@ -218,6 +218,29 @@
 CMD ["/bin/bash"]
 '''
 
+GITHUB_WORKFLOW_FILENAME = '.github/workflows/docker.yml'
+GITHUB_WORKFLOW_HEADER = '''
+name: Docker images
+
+# WARNING: generated file, use update.py for updates
+
+on: [push, pull_request]
+
+jobs:
+'''
+GITHUB_WORKFLOW_TEMPLATE = '''
+  image-{name}:
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+    uses: ./.github/workflows/lib-build-image.yml
+    with:
+      name: {name}
+      push: ${{{{ ((github.event_name == 'push') && contains(github.ref, '/tags/v')) }}}}
+
+'''
+
 
 def replace_shell_pseudo_variables(where, variables):
     if not variables:
@@ -284,6 +307,10 @@ def main():
             print("Updating {name} ...".format(**version_config), file=sys.stderr)
             update_version(f, version_config, docker_config)
 
+    with open(GITHUB_WORKFLOW_FILENAME, 'w') as f:
+        print(GITHUB_WORKFLOW_HEADER, file=f)
+        for version_config in VERSIONS:
+            print(GITHUB_WORKFLOW_TEMPLATE.format(**version_config), file=f)
 
 if __name__ == '__main__':
     main()