diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d94dc2c4..7f9907c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  REGISTRY: ghcr.io
+  LATEST_TAG: ghcr.io/agoric/agoric-3-proposals:latest
+
 jobs:
+  # see https://docs.docker.com/build/ci/github-actions/test-before-push/
   test-proposals:
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -29,12 +34,31 @@ jobs:
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"
           echo "=== After cleanup:"
           df -h
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        # see https://docs.github.com/en/actions/publishing-packages/publishing-docker-images
+        with:
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
+      # The .ts scripts depend upon this
       - run: yarn global add tsx
       - name: build test images
         run: ./buildTestImages.ts
       - name: run test images
         run: ./runTestImages.ts
+      # this should be fast because all the stages were already built
+      - name: Build and push complete image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ env.LATEST_TAG }}
       - name: notify on failure
         if: failure() && github.event_name != 'pull_request'
         uses: ./.github/actions/notify-status
diff --git a/makeDockerfile.ts b/makeDockerfile.ts
index 75a20f3f..aa44bc75 100755
--- a/makeDockerfile.ts
+++ b/makeDockerfile.ts
@@ -48,7 +48,7 @@ RUN /usr/src/upgrade-test-scripts/start_ag0.sh
 # PREPARE ${proposalName}
 
 # upgrading to ${planName}
-FROM use-${lastProposal.proposalName} as prepare-${proposalName}
+FROM ghcr.io/agoric/agoric-3-proposals:use-${lastProposal.proposalName} as prepare-${proposalName}
 ENV UPGRADE_TO=${planName}
 # base is a fresh sdk image so copy these supports
 COPY --link --chmod=755 ./upgrade-test-scripts/*.sh /usr/src/upgrade-test-scripts/
@@ -89,7 +89,7 @@ RUN ./start_to_to.sh
   ) {
     return `
 # EVAL ${proposalName}
-FROM use-${lastProposal.proposalName} as eval-${proposalName}
+FROM ghcr.io/agoric/agoric-3-proposals:use-${lastProposal.proposalName} as eval-${proposalName}
 
 COPY --link --chmod=755 ./proposals/${proposalIdentifier}:${proposalName} /usr/src/proposals/${proposalIdentifier}:${proposalName}
 
@@ -108,7 +108,7 @@ RUN ./run_eval.sh ${proposalIdentifier}:${proposalName}
       type === 'Software Upgrade Proposal' ? 'execute' : 'eval';
     return `
 # USE ${proposalName}
-FROM ${previousStage}-${proposalName} as use-${proposalName}
+FROM ghcr.io/agoric/agoric-3-proposals:${previousStage}-${proposalName} as use-${proposalName}
 
 COPY --link --chmod=755 ./proposals/${proposalIdentifier}:${proposalName} /usr/src/proposals/${proposalIdentifier}:${proposalName}
 
@@ -133,7 +133,7 @@ RUN ./run_use.sh ${proposalIdentifier}:${proposalName}
   TEST({ proposalName, proposalIdentifier }: ProposalInfo) {
     return `
 # TEST ${proposalName}
-FROM use-${proposalName} as test-${proposalName}
+FROM ghcr.io/agoric/agoric-3-proposals:use-${proposalName} as test-${proposalName}
 
 # XXX the test files were already copied in the "use" stage
 WORKDIR /usr/src/upgrade-test-scripts
@@ -166,8 +166,10 @@ for (const proposal of readProposals()) {
     blocks.push(stage.EXECUTE(proposal));
   }
 
-  blocks.push(stage.USE(proposal));
+  // TEST depends on USE but define it first but Docker can resolve the dependencies in any order.
   blocks.push(stage.TEST(proposal));
+  // Put USE last so that the last proposal is the default target to build.
+  blocks.push(stage.USE(proposal));
   previousProposal = proposal;
 }