diff --git a/docker/Dockerfile.release b/docker/Dockerfile.release
new file mode 100644
index 000000000..a2564b6d5
--- /dev/null
+++ b/docker/Dockerfile.release
@@ -0,0 +1,20 @@
+FROM --platform=$BUILDPLATFORM alpine:latest as helper
+
+ARG VERSION
+ARG TARGETOS
+ARG TARGETARCH
+
+# add release binary for the appropriate platform
+COPY restic_${VERSION}_${TARGETOS}_${TARGETARCH}.bz2 /
+RUN apk add --update --no-cache bzip2
+RUN set -e && \
+        bzcat restic_${VERSION}_${TARGETOS}_${TARGETARCH}.bz2 > restic && \
+        chmod +x restic
+
+
+FROM alpine:latest
+
+COPY --from=helper /restic /usr/bin
+RUN apk add --update --no-cache ca-certificates fuse openssh-client tzdata jq
+
+ENTRYPOINT ["/usr/bin/restic"]
diff --git a/helpers/prepare-release/main.go b/helpers/prepare-release/main.go
index 03924b0d9..2340a65d4 100644
--- a/helpers/prepare-release/main.go
+++ b/helpers/prepare-release/main.go
@@ -409,13 +409,19 @@ func signFiles(filenames ...string) {
 	}
 }
 
-func updateDocker(outputDir, version string) {
-	cmd := fmt.Sprintf("bzcat %s/restic_%s_linux_amd64.bz2 > restic", outputDir, version)
-	run("sh", "-c", cmd)
-	run("chmod", "+x", "restic")
-	run("docker", "pull", "alpine:latest")
-	run("docker", "build", "--rm", "--tag", "restic/restic:latest", "-f", "docker/Dockerfile", ".")
-	run("docker", "tag", "restic/restic:latest", "restic/restic:"+version)
+func updateDocker(outputDir, version string) string {
+	run("docker", "buildx", "create", "--name", "restic-release-builder", "--driver", "docker-container", "--bootstrap")
+
+	cmds := ""
+
+	for _, tag := range []string{"restic/restic:latest", "restic/restic:" + version} {
+		cmd := fmt.Sprintf("docker buildx build --builder restic-release-builder --platform linux/386,linux/amd64,linux/arm,linux/arm64 --pull --tag %q -f docker/Dockerfile.release --build-arg VERSION=%q %q", tag, version, outputDir)
+		run("sh", "-c", cmd)
+
+		cmds += cmd + " --push\n"
+	}
+
+	return cmds + "\ndocker buildx rm restic-release-builder"
 }
 
 func tempdir(prefix string) string {
@@ -470,9 +476,9 @@ func main() {
 
 	signFiles(filepath.Join(opts.OutputDir, "SHA256SUMS"), tarFilename)
 
-	updateDocker(opts.OutputDir, opts.Version)
+	dockerCmds := updateDocker(opts.OutputDir, opts.Version)
 
 	msg("done, output dir is %v", opts.OutputDir)
 
-	msg("now run:\n\ngit push --tags origin master\ndocker push restic/restic:latest\ndocker push restic/restic:%s\n", opts.Version)
+	msg("now run:\n\ngit push --tags origin master\n%s\n", dockerCmds)
 }