diff --git a/.github/workflows/container_base_push.yml b/.github/workflows/container_base_push.yml
index fc23b30d8ad..82c7a376ae0 100644
--- a/.github/workflows/container_base_push.yml
+++ b/.github/workflows/container_base_push.yml
@@ -5,16 +5,21 @@ on:
     push:
         branches:
             - 'develop'
+            - 'master'
         paths:
             - 'modules/container-base/**'
             - 'modules/dataverse-parent/pom.xml'
     pull_request:
         branches:
             - 'develop'
+            - 'master'
         paths:
             - 'modules/container-base/**'
             - 'modules/dataverse-parent/pom.xml'
 
+env:
+    IMAGE_TAG: develop
+    REGISTRY: docker.io
 
 jobs:
     build:
@@ -45,14 +50,21 @@ jobs:
                   key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
                   restore-keys: ${{ runner.os }}-m2
 
-            - name: Set up QEMU for multi-arch builds
-              uses: docker/setup-qemu-action@v2
-            - name: Build base container image
-              run: mvn -f modules/container-base -Pct package -Dtarget.java.version=${{ matrix.jdk }}
+            - name: Build base container image with local architecture
+              run: mvn -f modules/container-base -Pct package
 
             - if: ${{ github.event_name == 'push' }} # run only if this is a push - PRs have no access to secrets
               name: Log in to the Container registry
               uses: docker/login-action@v1
               with:
                   username: ${{ secrets.DOCKERHUB_USERNAME }}
-                  password: ${{ secrets.DOCKERHUB_TOKEN }}
\ No newline at end of file
+                  password: ${{ secrets.DOCKERHUB_TOKEN }}
+            - if: ${{ github.event_name == 'push' }} # run only if this is a push - multi-arch makes no sense with PR
+              name: Set up QEMU for multi-arch builds
+              uses: docker/setup-qemu-action@v2
+            - name: Re-set image tag based on branch
+              if: ${{ github.ref == 'master' }}
+              run: echo "IMAGE_TAG=release"
+            - if: ${{ github.event_name == 'push' }} # run only if this is a push - tag push will only succeed in upstream
+              name: Deploy multi-arch base container image to Docker Hub
+              run: mvn -f modules/container-base -Pct deploy -Dbase.image.tag=${{ env.IMAGE_TAG }} -Ddocker.registry=${{ env.REGISTRY }}