diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a119d4d..db77149 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -129,7 +129,7 @@ jobs:
       - name: Install cosign
         uses: sigstore/cosign-installer@v3
 
-      - name: Build and push Docker image
+      - name: Build and push Docker images
         id: build-push
         env:
           IMAGE_TAG: ${{ github.sha }}
@@ -139,6 +139,9 @@ jobs:
           DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' ghcr.io/buffden/tinyurl-api:$IMAGE_TAG)
           echo "digest=$DIGEST" >> $GITHUB_OUTPUT
 
+          docker build -t ghcr.io/buffden/tinyurl-nginx:$IMAGE_TAG infra/nginx/
+          docker push ghcr.io/buffden/tinyurl-nginx:$IMAGE_TAG
+
       - name: Sign Docker image with cosign (keyless)
         env:
           IMAGE_TAG: ${{ github.sha }}
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 6e21676..1f3f2ee 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -5,13 +5,12 @@
 
 services:
   nginx:
-    image: nginx:1.27-alpine
+    image: ghcr.io/buffden/tinyurl-nginx:${IMAGE_TAG}
     container_name: tinyurl-nginx
     ports:
       - "80:80"
       - "443:443"
     volumes:
-      - ./infra/nginx/nginx.prod.conf:/etc/nginx/nginx.conf:ro
       - /etc/letsencrypt:/etc/letsencrypt:ro
     depends_on:
       app:
diff --git a/infra/nginx/Dockerfile b/infra/nginx/Dockerfile
new file mode 100644
index 0000000..a9d06ea
--- /dev/null
+++ b/infra/nginx/Dockerfile
@@ -0,0 +1,3 @@
+FROM nginx:1.27-alpine
+
+COPY nginx.prod.conf /etc/nginx/nginx.conf