diff --git a/.dockerignore b/.dockerignore
index 9c75081..c0eb216 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -11,7 +11,7 @@
 .gitignore
 .gitattributes
 .gitlab-ci.yml
-.gitlab-ci.local/
+.gitlab-ci-local/
 .github/
 
 # Ignore the Dockerfile itself
@@ -47,3 +47,7 @@
 Makefile
 Makefile.old
 pm_to_blib
+
+# Ignore image and release tarballs, they have no business in the image
+*.tar.gz
+*.tar.xz
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b4ada36..cfee89e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -95,8 +95,12 @@
 
 build-docker:
   image: docker:latest
+  variables:
+    # the mint container has to reach the container it probes
+    FF_NETWORK_PER_BUILD: "true"
   services:
-    - docker:dind
+    - name: docker:dind
+      command: [--dns=127.0.0.11]
   rules:
     - if: $CI_COMMIT_TAG =~ /.+/
       variables:
@@ -109,34 +113,41 @@
     - apk update
     - apk add --no-cache git
   script:
+    # the http probe needs a model to serve, so keep the example models in the
+    # large image and remove them further down with Dockerfile.remove-example-data
     - sed -i -e "s/RUN rm -rf example-models//" Dockerfile
     - docker build -f Dockerfile -t idscorpuslinguistics/derekovecs:$VID-large .
-    - wget https://github.com/slimtoolkit/slim/releases/latest/download/dist_linux.tar.gz
-    - tar zxf dist_linux.tar.gz
-    - export PATH=$(pwd)/dist_linux:$PATH
-    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock dslim/slim --in-container build --http-probe-start-wait 10 --include-workdir --include-path /usr/local --env MOJO_CONFIG=/derekovecs/example-models/example-docker.conf --tag idscorpuslinguistics/derekovecs:tmp idscorpuslinguistics/derekovecs:$VID-large
+    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock mintoolkit/mint --crt-api-version 1.46 build --http-probe=true --http-probe-start-wait 60 --include-workdir=true --include-path=/usr/local --env MOJO_CONFIG=/derekovecs/example-models/example-docker.conf --tag idscorpuslinguistics/derekovecs:tmp idscorpuslinguistics/derekovecs:$VID-large || true
     - docker build -f Dockerfile.remove-example-data --tag idscorpuslinguistics/derekovecs:latest --tag idscorpuslinguistics/derekovecs:$VID .
-    - docker save idscorpuslinguistics/derekovecs:$VID | xz -T0 -M16G -9 > derekovecs.tar.xz
+    - ARTIFACT=derekovecs-${VID}.tar.xz
+    - docker save idscorpuslinguistics/derekovecs:$VID | xz -T0 -M16G -9 > "$ARTIFACT"
   artifacts:
     paths:
-      - derekovecs.tar.xz
+      - derekovecs-*.tar.xz
 
 upload-docker:
-  only:
-    - master
-    - tags
-  variables:
-    VID: $CI_COMMIT_TAG
   stage: deploy
   image: docker:latest
   services:
-    - docker:dind
-  script:
-    - unxz -c derekovecs.tar.xz | docker load
-    - echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USERNAME" --password-stdin
-    - docker push idscorpuslinguistics/derekovecs:$VID
-    - docker push idscorpuslinguistics/derekovecs
+    - name: docker:dind
+      command: [--dns=127.0.0.11]
+  needs:
+    - job: build-docker
+      artifacts: true
   dependencies:
     - build-docker
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v.+/
+      when: manual
+    - when: never
+  script:
+    - apk update
+    - apk add --no-cache xz
+    - ARTIFACT=derekovecs-${CI_COMMIT_TAG}.tar.xz
+    - xz -d -c "$ARTIFACT" | docker load
+    - echo "$DOCKER_HUB_PASSWORD" | docker login -u "$DOCKER_HUB_USERNAME" --password-stdin
+    - docker tag idscorpuslinguistics/derekovecs:$CI_COMMIT_TAG idscorpuslinguistics/derekovecs:latest
+    - docker push idscorpuslinguistics/derekovecs:$CI_COMMIT_TAG
+    - docker push idscorpuslinguistics/derekovecs:latest
   environment:
     name: production