diff --git a/.forgejo/workflows/build-keycloak.yaml b/.forgejo/workflows/build-keycloak.yaml
index 51c89ef..bd7663d 100644
--- a/.forgejo/workflows/build-keycloak.yaml
+++ b/.forgejo/workflows/build-keycloak.yaml
@@ -4,7 +4,7 @@ on:
       - containers/keycloak/*
       - .forgejo/workflows/build-keycloak.yaml
 jobs:
-  build-synapse:
+  build-keycloak:
     runs-on: docker
     container:
       image: library/docker:dind
diff --git a/.forgejo/workflows/build-traefik-forward-auth.yaml b/.forgejo/workflows/build-traefik-forward-auth.yaml
index 0e808f9..5562649 100644
--- a/.forgejo/workflows/build-traefik-forward-auth.yaml
+++ b/.forgejo/workflows/build-traefik-forward-auth.yaml
@@ -1,9 +1,8 @@
 on:
   push:
     paths:
+      - containers/traefik-forward-auth/*
       - .forgejo/workflows/build-traefik-forward-auth.yaml
-env:
-  VERSION: v2.3.0
 jobs:
   build-traefik-forward-auth:
     runs-on: docker
@@ -11,14 +10,13 @@ jobs:
       image: library/docker:dind
     steps:
       - run: apk add --no-cache nodejs git
-      - name: checkout traefik-forward-auth
-        run: git clone -b ${VERSION} https://github.com/thomseddon/traefik-forward-auth
       - name: login to container registry
         run: echo "${{ secrets.DEPLOY_TOKEN }}" | docker login --username ${{ secrets.DEPLOY_USER }} --password-stdin git.janky.solutions
       - name: build container image
         uses: docker/build-push-action@v4
         with:
-          context: traefik-forward-auth/
-          tags: git.janky.solutions/jankysolutions/infra/traefik-forward-auth:${{ env.VERSION }}
+          file: Containerfile
+          context: "{{defaultContext}}:containers/traefik-forward-auth"
+          tags: git.janky.solutions/jankysolutions/infra/traefik-forward-auth:latest
           platforms: linux/amd64
           push: true
diff --git a/containers/traefik-forward-auth/Containerfile b/containers/traefik-forward-auth/Containerfile
new file mode 100644
index 0000000..5cbc194
--- /dev/null
+++ b/containers/traefik-forward-auth/Containerfile
@@ -0,0 +1,10 @@
+FROM library/golang:1.22 as builder
+RUN git clone -b v2.3.0 https://github.com/thomseddon/traefik-forward-auth /go/traefik-forward-auth
+WORKDIR /go/traefik-forward-auth
+RUN CGO_ENABLED=0 go build -a -installsuffix nocgo -o /traefik-forward-auth ./cmd
+
+# Copy into scratch container
+FROM scratch
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /traefik-forward-auth ./
+ENTRYPOINT ["./traefik-forward-auth"]