diff --git a/.gitea/workflows/main.yaml b/.gitea/workflows/main.yaml
index dcb0119..1df1a47 100644
--- a/.gitea/workflows/main.yaml
+++ b/.gitea/workflows/main.yaml
@@ -65,6 +65,9 @@ jobs:
           echo REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F"/" '{print tolower($2)}') >> $GITHUB_OUTPUT
           echo REPO_VERSION=$(git describe --tags --always | sed 's/^v//') >> $GITHUB_OUTPUT                
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+
       - name: Build and push
         uses: docker/build-push-action@v4
         with:
@@ -72,7 +75,6 @@ jobs:
           file: ./Dockerfile
           platforms: |
             linux/amd64
-            linux/arm64                        
           push: true
           tags: |
             ${{ env.GITEA_INSTANCE_URL }}/${{ steps.meta.outputs.REPO_OWNER }}/${{ steps.meta.outputs.REPO_NAME }}:${{ steps.meta.outputs.REPO_VERSION }}
diff --git a/Dockerfile b/Dockerfile
index 59e502e..04bc71f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,21 +1,35 @@
-FROM mcr.microsoft.com/dotnet/aspnet:7.0 AS base
+FROM mcr.microsoft.com/dotnet/runtime-deps:7.0-alpine AS base
 WORKDIR /app
 EXPOSE 5000
 
-FROM mcr.microsoft.com/dotnet/sdk:7.0-bullseye-slim-amd64 AS build
-WORKDIR /src
+FROM --platform=$BUILDPLATFORM mcr.microsoft.com/dotnet/sdk:7.0-alpine AS build
 ARG TARGETARCH
-ARG TARGETOS
-RUN arch=$TARGETARCH \
-    && if [ "$arch" = "amd64" ]; then arch="x64"; fi \
-    && echo $TARGETOS-$arch > /tmp/rid
+ARG BUILDPLATFORM
+
+WORKDIR /src
 COPY *.csproj .
-RUN dotnet restore -r $(cat /tmp/rid)
+RUN dotnet restore -r
 COPY . .
 WORKDIR "/src"
-RUN dotnet publish -c Release -o /app -r $(cat /tmp/rid) --self-contained false --no-restore
+RUN dotnet build -c Release -o /app/build -a $TARGETARCH
 
-FROM base AS final
+FROM build AS publish
+RUN dotnet public -c Release -o /app/publish \
+    --self-contained true \
+    /p:PublishTrimmed=true \
+    /p:PublishSingleFile=true \
+    -a $TARGETARCH
+
+FROM --platform=$BUILDPLATFORM base AS final
+ARG TARGETARCH
+ARG BUILDPLATFORM
+
+RUN adduser --disabled-password \
+  --home /app \
+  --gecos '' dotnetuser && chown -R dotnetuser /app 
+
+USER dotnetuser
 WORKDIR /app
-COPY --from=build /app .
-ENTRYPOINT ["dotnet", "MauMau-Server.dll"]
\ No newline at end of file
+
+COPY --from=publish /app/publish .
+ENTRYPOINT ["./MauMau-Server"]
\ No newline at end of file