diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1e9403f..2dbff33 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,7 +19,7 @@ jobs:
       attestations: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -56,3 +56,27 @@ jobs:
           subject-name: ghcr.io/github/artifact-attestations-opa-provider
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
+
+      - name: Log in to Azure Container Registry (ACR)
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ secrets.ACR_MODA_REGISTRY }}
+          username: ${{ secrets.ACR_MODA_USER }}
+          password: ${{ secrets.ACR_MODA_TOKEN }}
+
+      - name: Build and push Docker image to ACR
+        id: build
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
+          platforms: linux/amd64,linux/arm64
+
+      - name: Attest build provenance for ACR
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true