diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d94dc2c4..7f9907c0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,12 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+env:
+  REGISTRY: ghcr.io
+  LATEST_TAG: ghcr.io/agoric/agoric-3-proposals:latest
+
 jobs:
+  # see https://docs.docker.com/build/ci/github-actions/test-before-push/
   test-proposals:
     runs-on: ubuntu-latest
     timeout-minutes: 60
@@ -29,12 +34,31 @@ jobs:
           sudo rm -rf "$AGENT_TOOLSDIRECTORY"
           echo "=== After cleanup:"
           df -h
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        # see https://docs.github.com/en/actions/publishing-packages/publishing-docker-images
+        with:
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: ${{ env.REGISTRY }}
+      # The .ts scripts depend upon this
       - run: yarn global add tsx
       - name: build test images
         run: ./buildTestImages.ts
       - name: run test images
         run: ./runTestImages.ts
+      # this should be fast because all the stages were already built
+      - name: Build and push complete image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ${{ env.LATEST_TAG }}
       - name: notify on failure
         if: failure() && github.event_name != 'pull_request'
         uses: ./.github/actions/notify-status
diff --git a/makeDockerfile.ts b/makeDockerfile.ts
index 75a20f3f..d2b7b064 100755
--- a/makeDockerfile.ts
+++ b/makeDockerfile.ts
@@ -135,10 +135,22 @@ RUN ./run_use.sh ${proposalIdentifier}:${proposalName}
 # TEST ${proposalName}
 FROM use-${proposalName} as test-${proposalName}
 
-# XXX the test files were already copied in the "use" stage
 WORKDIR /usr/src/upgrade-test-scripts
 SHELL ["/bin/bash", "-c"]
 ENTRYPOINT ./run_test.sh ${proposalIdentifier}:${proposalName}
+`;
+  },
+  /**
+   * The last target in the file, for untargeted `docker build`
+   */
+  DEFAULT(lastProposal: ProposalInfo) {
+    return `
+# DEFAULT
+FROM use-${lastProposal.proposalName}
+
+WORKDIR /usr/src/upgrade-test-scripts
+SHELL ["/bin/bash", "-c"]
+ENTRYPOINT ./start_agd.sh
 `;
   },
 };
@@ -166,10 +178,13 @@ for (const proposal of readProposals()) {
     blocks.push(stage.EXECUTE(proposal));
   }
 
+  // The stages must be output in dependency order because if the builder finds a FROM
+  // that it hasn't built yet, it will search for it in the registry. But it won't be there!
   blocks.push(stage.USE(proposal));
   blocks.push(stage.TEST(proposal));
   previousProposal = proposal;
 }
+blocks.push(stage.DEFAULT(previousProposal!));
 
 export function refreshDockerfile() {
   const contents = blocks.join('\n');