diff --git a/.gitignore b/.gitignore
index b25c15b8..972873c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 *~
+*.uf2
diff --git a/Dockerfile b/Dockerfile
index 433aaad8..268b5b14 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,28 +1,44 @@
-FROM nixpkgs/nix:nixos-23.05
+FROM nixpkgs/nix:nixos-23.11
 
 ENV PATH=/root/.nix-profile/bin:/usr/bin:/bin
 
-RUN set -e -x; \
-    nix-env -iA cachix -f https://cachix.org/api/v1/install; \
-    cachix use moergo-glove80-zmk-dev; \
-    mkdir -p /glove80-zmk-config/config; \
-    git clone -b main https://github.com/moergo-sc/zmk /glove80-zmk-config/src; \
-    : Pre-build zmk to populate the nix store with the dependencies; \
-    cd /glove80-zmk-config/src; \
-    nix-shell --run true --attr zmk .
-
-RUN set -e -x; \
-    (\
-    echo '#!/bin/bash'; \
-    echo 'DST=$PWD'; \
-    echo 'set -e -x'; \
-    echo 'cp -v config/* /glove80-zmk-config/config'; \
-    echo 'cd /glove80-zmk-config'; \
-    echo 'nix-build config -o combined'; \
-    echo 'cp -v combined/glove80.uf2 "$DST/glove80.uf2"'; \
-    echo 'chown "$UID:$GID" "$DST/glove80.uf2"'; \
-    ) > entrypoint.sh; \
-    chmod a+x entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]
+RUN <<EOF
+    set -euo pipefail
+    nix-env -iA cachix -f https://cachix.org/api/v1/install
+    cachix use moergo-glove80-zmk-dev
+    mkdir /config
+    # Mirror ZMK repository to make it easier to reference both branches and
+    # tags without remote namespacing
+    git clone --mirror https://github.com/moergo-sc/zmk /zmk
+    GIT_DIR=/zmk git worktree add --detach /src
+EOF
+
+# Prepopulate the container's nix store with the build dependencies for the main
+# branch and the most recent three tags
+RUN <<EOF
+    cd /src
+    for tag in main $(git tag -l --sort=committerdate | tail -n 3); do
+      git checkout -q --detach $tag
+      nix-shell --run true -A zmk ./default.nix
+    done
+EOF
+
+COPY --chmod=755 <<EOF /bin/entrypoint.sh
+#!/usr/bin/env bash
+    set -euo pipefail
+    : "\${BRANCH:=main}"
+
+    echo "Checking out \$BRANCH from moergo-sc/zmk" >&2
+    cd /src
+    git fetch origin
+    git checkout -q --detach "\$BRANCH"
+
+    echo 'Building Glove80 firmware' >&2
+    cd /config
+    nix-build ./config --arg firmware 'import /src/default.nix {}' -j2 -o /tmp/combined --show-trace
+    install -o "\$UID" -g "\$GID" /tmp/combined/glove80.uf2 ./glove80.uf2
+EOF
+
+ENTRYPOINT ["/bin/entrypoint.sh"]
 
 # Run build.sh to use this file
diff --git a/build.sh b/build.sh
index c51c5a85..73249c4a 100755
--- a/build.sh
+++ b/build.sh
@@ -1,8 +1,9 @@
 #!/bin/bash
 
-IMAGE=glove80
+set -euo pipefail
 
-set -e -x
+IMAGE=glove80-zmk-config-docker
+BRANCH="${1:-main}"
 
 docker build -t "$IMAGE" .
-docker run --rm -v "$PWD:$PWD" -w "$PWD" -e UID="$(id -u)" -e GID="$(id -g)" "$IMAGE"
+docker run --rm -v "$PWD:/config" -e UID="$(id -u)" -e GID="$(id -g)" -e BRANCH="$BRANCH" "$IMAGE"
diff --git a/config/default.nix b/config/default.nix
index 0d9645c9..c781cb68 100644
--- a/config/default.nix
+++ b/config/default.nix
@@ -1,7 +1,8 @@
-{ pkgs ?  import <nixpkgs> {} }:
+{ pkgs ?  import <nixpkgs> {}
+, firmware ? import ../src {}
+}:
 
 let
-  firmware = import ../src {};
   config = ./.;
 
   glove80_left  = firmware.zmk.override { board = "glove80_lh"; keymap = "${config}/glove80.keymap"; kconfig = "${config}/glove80.conf"; };