diff --git a/.circleci/config.yml b/.circleci/config.yml
deleted file mode 100644
index cb72179..0000000
--- a/.circleci/config.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-version: 2
-jobs:
-  build:
-    docker:
-      - image: cimg/go:1.15
-    steps:
-      - checkout
-      - setup_remote_docker
-      - deploy:
-          name: Build and push image
-          command: |
-            echo "$DOCKER_PASS" | docker login --username "$DOCKER_USER" --password-stdin
-            if [ -z "${CIRCLE_TAG}" ]; then
-                make publish-image
-            else
-                make VERSION="${CIRCLE_TAG}" publish-image
-            fi
-
-workflows:
-  version: 2
-  build:
-    jobs:
-     - build:
-         filters:
-           tags:
-             only: /.*/
-           branches:
-             ignore: gh-pages
diff --git a/.github/workflows/on-master-push.yaml b/.github/workflows/on-master-push.yaml
new file mode 100644
index 0000000..2d5a826
--- /dev/null
+++ b/.github/workflows/on-master-push.yaml
@@ -0,0 +1,38 @@
+# We publish every merged commit in the form of an image
+# named kured:<branch>-<short tag>
+name: Push image of latest master
+on:
+  push:
+    branches:
+      - master
+jobs:
+  tag-scan-and-push-final-image:
+    name: "Build, scan, and publish tagged image"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+
+      - name: Find go version
+        run: |
+          GO_VERSION=$(awk '/^go/ {print $2};' go.mod)
+          echo "::set-output name=version::${GO_VERSION}"
+        id: awk_gomod
+
+      - name: Ensure go version
+        uses: actions/setup-go@v2
+        with:
+          go-version: "${{ steps.awk_gomod.outputs.version }}"
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME_WEAVEWORKSKUREDCI }}
+          password: ${{ secrets.DOCKERHUB_TOKEN_WEAVEWORKSKUREDCI }}
+
+      - name: Build image
+        run: |
+          make DH_ORG="${{ github.repository_owner }}" image
+
+      - name: Publish image
+        run: |
+          make DH_ORG="${{ github.repository_owner }}" publish-image
diff --git a/.github/workflows/on-tag.yaml b/.github/workflows/on-tag.yaml
index c6b23e9..57153a0 100644
--- a/.github/workflows/on-tag.yaml
+++ b/.github/workflows/on-tag.yaml
@@ -24,7 +24,17 @@ jobs:
           go-version: "${{ steps.awk_gomod.outputs.version }}"
       - run: |
           make DH_ORG="${{ github.repository_owner }}" VERSION="${GITHUB_REF#refs/tags/}" image
+
       - uses: Azure/container-scan@v0
         with:
           image-name: docker.io/${{ github.repository_owner }}/kured:${GITHUB_REF#refs/tags/}
-      # We should add a step to publish the image on tag.
+
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME_WEAVEWORKSKUREDCI }}
+          password: ${{ secrets.DOCKERHUB_TOKEN_WEAVEWORKSKUREDCI }}
+
+      - name: Publish image
+        run: |
+          make DH_ORG="${{ github.repository_owner }}" VERSION="${GITHUB_REF#refs/tags/}" publish-image
diff --git a/README.md b/README.md
index f82b228..f36430a 100644
--- a/README.md
+++ b/README.md
@@ -283,8 +283,7 @@ Using `--lock-ttl=30m` will allow other nodes to take over if TTL has expired (i
 
 ## Building
 
-See the [CircleCI config](.circleci/config.yml) for the preferred
-version of Golang. Kured now uses [Go
+Kured now uses [Go
 Modules](https://github.com/golang/go/wiki/Modules), so build
 instructions vary depending on where you have checked out the
 repository:
@@ -301,6 +300,8 @@ make
 GO111MODULE=on make
 ```
 
+You can find the current preferred version of Golang in the [go.mod file](go.mod).
+
 If you are interested in contributing code to kured, please take a look at
 our [development][development] docs.