diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4184ed8..af2c458 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -72,10 +72,33 @@ jobs:
         username: ${{ secrets.DOCKER_HUB_USERNAME }}
         password: ${{ secrets.DOCKER_HUB_TOKEN }}
 
+    - name: Login to ghcr.io
+      if: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
+      uses: docker/login-action@v2
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ github.token }}
+
     - name: Build docker image
       env:
-        DOCKER_REGISTRY: docker.io
         DOCKER_PUSH: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }}
         TRIVY_GITHUB_TOKEN: ${{ github.token }}
       run: |
         bash build-image.sh
+
+    - name: Delete untagged images
+      uses: actions/github-script@v6
+      if: ${{ github.ref_name == 'main' && github.event_name != 'pull_request' && !env.ACT }} # https://github.com/nektos/act#skipping-steps
+      with:
+        github-token: ${{ secrets.GHA_DELETE_PACKAGES }}
+        script: |
+          const imageName = /[^/]*$/.exec(process.env.DOCKER_IMAGE_REPO)[0]
+          const basePath = `/orgs/${{ github.repository_owner }}/packages/container/${imageName}/versions`
+          for (version of (await github.request(`GET ${basePath}`, { per_page: 100 })).data) {
+            if (version.metadata.container.tags.length == 0) {
+              console.log(`deleting ${version.name}...`)
+              const delResponse = await github.request(`DELETE ${basePath}/${version.id}`)
+              console.log(`status: ${delResponse.status}`)
+            }
+          }
diff --git a/build-image.sh b/build-image.sh
index ad6823c..592d293 100644
--- a/build-image.sh
+++ b/build-image.sh
@@ -5,15 +5,18 @@
 # SPDX-License-Identifier: Apache-2.0
 # SPDX-ArtifactOfProjectHomePage: https://github.com/vegardit/docker-openldap
 
+function curl() {
+  command curl -sSfL --connect-timeout 10 --max-time 30 --retry 3 --retry-all-errors "$@"
+}
+
 shared_lib="$(dirname $0)/.shared"
-[ -e "$shared_lib" ] || curl -sSf https://raw.githubusercontent.com/vegardit/docker-shared/v1/download.sh?_=$(date +%s) | bash -s v1 "$shared_lib" || exit 1
+[ -e "$shared_lib" ] || curl https://raw.githubusercontent.com/vegardit/docker-shared/v1/download.sh?_=$(date +%s) | bash -s v1 "$shared_lib" || exit 1
 source "$shared_lib/lib/build-image-init.sh"
 
 
 #################################################
-# specify target docker registry/repo
+# specify target repo and image name
 #################################################
-docker_registry=${DOCKER_REGISTRY:-docker.io}
 image_repo=${DOCKER_IMAGE_REPO:-vegardit/openldap}
 base_image_name=${DOCKER_BASE_IMAGE:-debian:bullseye-slim}
 base_image_tag=${base_image_name#*:}
@@ -23,26 +26,28 @@ image_name=$image_repo:latest
 #################################################
 # build the image
 #################################################
-echo "Building docker image [$image_name]..."
+log INFO "Building docker image [$image_name]..."
 if [[ $OSTYPE == "cygwin" || $OSTYPE == "msys" ]]; then
-   project_root=$(cygpath -w "$project_root")
+  project_root=$(cygpath -w "$project_root")
 fi
 
+set -x
 docker pull $base_image_name
 DOCKER_BUILDKIT=1 docker build "$project_root" \
-   --file "image/Dockerfile" \
-   --progress=plain \
-   --build-arg INSTALL_SUPPORT_TOOLS=${INSTALL_SUPPORT_TOOLS:-0} \
-   `# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day` \
-   --build-arg BASE_LAYER_CACHE_KEY=$base_layer_cache_key \
-   --build-arg BASE_IMAGE=$base_image_name \
-   --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
-   --build-arg GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}" \
-   --build-arg GIT_COMMIT_DATE="$(date -d @$(git log -1 --format='%at') --utc +'%Y-%m-%d %H:%M:%S UTC')" \
-   --build-arg GIT_COMMIT_HASH="$(git rev-parse --short HEAD)" \
-   --build-arg GIT_REPO_URL="$(git config --get remote.origin.url)" \
-   -t $image_name \
-   "$@"
+  --file "image/Dockerfile" \
+  --progress=plain \
+  --build-arg INSTALL_SUPPORT_TOOLS=${INSTALL_SUPPORT_TOOLS:-0} \
+  `# using the current date as value for BASE_LAYER_CACHE_KEY, i.e. the base layer cache (that holds system packages with security updates) will be invalidate once per day` \
+  --build-arg BASE_LAYER_CACHE_KEY=$base_layer_cache_key \
+  --build-arg BASE_IMAGE=$base_image_name \
+  --build-arg BUILD_DATE=$(date -u +"%Y-%m-%dT%H:%M:%SZ") \
+  --build-arg GIT_BRANCH="${GIT_BRANCH:-$(git rev-parse --abbrev-ref HEAD)}" \
+  --build-arg GIT_COMMIT_DATE="$(date -d @$(git log -1 --format='%at') --utc +'%Y-%m-%d %H:%M:%S UTC')" \
+  --build-arg GIT_COMMIT_HASH="$(git rev-parse --short HEAD)" \
+  --build-arg GIT_REPO_URL="$(git config --get remote.origin.url)" \
+  -t $image_name \
+  "$@"
+set +x
 
 
 #################################################
@@ -63,21 +68,29 @@ tags+=($image_repo:${ldap_version%.*}.x)  # :2.4.x
 tags+=($image_repo:${ldap_version%%.*}.x) # :2.x
 
 for tag in ${tags[@]}; do
-   docker image tag $image_name $tag
+  docker image tag $image_name $tag
+  if [[ "${DOCKER_PUSH:-}" == "true" ]]; then
+    docker image tag $image_name ghcr.io/$tag
+  fi
 done
 
 
 #################################################
 # perform security audit
 #################################################
-bash "$shared_lib/cmd/audit-image.sh" $image_name
+if [[ "${DOCKER_AUDIT_IMAGE:-1}" == 1 ]]; then
+  bash "$shared_lib/cmd/audit-image.sh" $image_name
+fi
 
 
 #################################################
 # push image with tags to remote docker image registry
 #################################################
-if [[ "${DOCKER_PUSH:-0}" == "1" ]]; then
-   for tag in ${tags[@]}; do
-      docker push $docker_registry/$tag
-   done
+if [[ "${DOCKER_PUSH:-}" == "true" ]]; then
+  for tag in ${tags[@]}; do
+    set -x
+    docker push $tag
+    docker push ghcr.io/$tag
+    set +x
+  done
 fi