diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
new file mode 100644
index 00000000..89dfb126
--- /dev/null
+++ b/.github/workflows/build.yaml
@@ -0,0 +1,13 @@
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  build:
+    uses: ./.github/workflows/maven.yaml
+    with:
+      build-images: ${{ github.ref_name == 'main' }}
+      release-version: dev
+    secrets: inherit
diff --git a/.github/workflows/maven.yaml b/.github/workflows/maven.yaml
new file mode 100644
index 00000000..100c9591
--- /dev/null
+++ b/.github/workflows/maven.yaml
@@ -0,0 +1,79 @@
+env:
+  JAVA_VERSION: 17
+  REGISTRY: ghcr.io
+  TZ: Europe/Berlin
+
+on:
+  workflow_call:
+    inputs:
+      snapshot-release:
+        description: 'Snapshot release?'
+        type: boolean
+        default: true
+      build-images:
+        description: 'Build and push images?'
+        type: boolean
+        default: false
+      release-version:
+        description: 'Release version'
+        type: string
+        required: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout source code, set up Java, etc. Then...
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Set up JDK
+        uses: actions/setup-java@v4
+        with:
+          java-version: ${{ env.JAVA_VERSION }}
+          distribution: "temurin"
+          cache: "maven"
+      - name: Maven build
+        run: mvn --batch-mode clean install
+      - name: "Upload Artifact"
+        uses: actions/upload-artifact@v4
+        with:
+          name: target
+          path: "**/target"
+          retention-days: 5
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  build-image:
+    if: inputs.build-images == true
+    needs: release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Download a single artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: target
+      - name: Login to Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # refarch-gateway
+      - name: Extract metadata (tags, labels) for gateway image
+        id: gateway_meta
+        uses: docker/metadata-action@v5
+        with:
+          images: "${{ env.REGISTRY }}/${{ github.repository }}/refarch-gateway"
+          tags: |
+            type=raw,value=${{ inputs.release-version }}
+            type=raw,value=latest,enable=${{ inputs.snapshot-release == false }}
+      - name: Build and push gateway image
+        uses: docker/build-push-action@v4
+        with:
+          context: ./refarch-gateway
+          push: true
+          tags: ${{ steps.gateway_meta.outputs.tags }}
+          labels: ${{ steps.gateway_meta.outputs.labels }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 00000000..5615e269
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,24 @@
+on:
+  workflow_dispatch:
+    inputs:
+      snapshot-release:
+        description: 'Snapshot release?'
+        type: boolean
+        default: true
+      build-images:
+        description: 'Build and push images?'
+        type: boolean
+        default: false
+      release-version:
+        description: 'Release version'
+        type: string
+        required: false
+
+jobs:
+  build:
+    uses: ./.github/workflows/maven.yaml
+    with:
+      snapshot-release: ${{ inputs.snapshot-release != false }}
+      build-images: true
+      release-version: ${{ inputs.release-version }}
+    secrets: inherit