diff --git a/.github/workflows/upgrade-aws.yml b/.github/workflows/upgrade-aws.yml
new file mode 100644
index 0000000..8879796
--- /dev/null
+++ b/.github/workflows/upgrade-aws.yml
@@ -0,0 +1,66 @@
+on:
+  push:
+    branches:
+      - master
+name: ECR
+env:
+  DOCKER_BUILDKIT: 1
+  COMPOSE_DOCKER_CLI_BUILD: 1
+jobs:
+  prepare-ecr:
+    name: Prepare ECR
+    runs-on: ubuntu-latest
+    timeout-minutes: 1
+    outputs:
+      role: ${{ steps.prepare.outputs.role }}
+      branch: ${{ steps.prepare.outputs.branch }}
+    steps:
+      - name: Prepare
+        id: prepare
+        run: |
+          case ${{github.ref}} in
+            refs/heads/master)
+              role=arn:aws:iam::983851922138:role/GHA,github-actions-php-cs-fixer
+              branch=master
+              ;;
+            *)
+              echo "Unknown ref: ${{github.ref}}"
+              exit 1
+              ;;
+          esac
+          echo branch: $branch
+          echo role: $role
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+          echo "role=$role" >> $GITHUB_OUTPUT
+  ecr:
+    name: ECR
+    runs-on: ubuntu-latest
+    needs: [prepare-ecr]
+    timeout-minutes: 15
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Docker Compose
+        run: |
+          if [ ! -f docker-compose.${{needs.prepare-ecr.outputs.branch}}.yml ]; then
+            echo 'version: "3.8"' > docker-compose.${{needs.prepare-ecr.outputs.branch}}.yml
+          fi
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - uses: aws-actions/configure-aws-credentials@v1
+        name: Configure AWS Credentials (eu-central-1)
+        with:
+          role-to-assume: ${{needs.prepare-ecr.outputs.role}}
+          aws-region: us-east-1
+          role-duration-seconds: 900
+      - name: Login to Amazon ECR
+        id: login-ecr
+        uses: aws-actions/amazon-ecr-login@v1
+        with:
+          registry-type: 'public'
+      - name: Build
+        run: docker compose build --build-arg BUILDKIT_INLINE_CACHE=1
+      - name: Push
+        run: docker compose push
diff --git a/Dockerfile b/Dockerfile
index 8db475c..e65746a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,13 +1,14 @@
-FROM --platform=linux/amd64 php:8.1-alpine
+FROM --platform=linux/amd64 php:8.1.34-cli-alpine
 
 LABEL "com.github.actions.name"="PHP-CS-Fixer"
 LABEL "com.github.actions.description"="check php files"
 LABEL "com.github.actions.icon"="check"
 LABEL "com.github.actions.color"="blue"
 
-RUN wget https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v3.13.0/php-cs-fixer.phar -O php-cs-fixer \
-    && chmod a+x php-cs-fixer \
-    && mv php-cs-fixer /usr/local/bin/php-cs-fixer
+# Pin PHP 8.1.34 to match mobsuccess (same digest as php:8.1-alpine today).
+RUN wget -O /usr/local/bin/php-cs-fixer \
+      https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases/download/v3.13.0/php-cs-fixer.phar \
+    && chmod a+x /usr/local/bin/php-cs-fixer
 
-ADD entrypoint.sh /entrypoint.sh
+COPY entrypoint.sh /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
diff --git a/action.yml b/action.yml
index 193b3cc..ac75bc3 100644
--- a/action.yml
+++ b/action.yml
@@ -12,4 +12,4 @@ name: 'OSKAR-PHP-CS-Fixer'
 
 runs:
     using: 'docker'
-    image: 'docker://oskarstark/php-cs-fixer-ga:2.18.2'
+    image: 'docker://public.ecr.aws/u9q7y3l4/github-actions-php-cs-fixer:v3.13.0'