diff --git a/.github/workflows/dockerhub-publish.yml b/.github/workflows/dockerhub-publish.yml
new file mode 100644
index 000000000..b8deeae93
--- /dev/null
+++ b/.github/workflows/dockerhub-publish.yml
@@ -0,0 +1,86 @@
+# Build and push docker.io/linkpool/erpc:<tag> from an arbitrary git ref.
+# Used for canary/prod experiment tags (e.g. pin-near-tip-getblock-test9).
+#
+# Required repo secrets:
+#   DOCKERHUB_USERNAME — Docker Hub user with write to the `linkpool` org
+#   DOCKERHUB_TOKEN    — access token for that user
+#
+# Run: Actions → "Publish to Docker Hub" → workflow_dispatch
+#   tag: pin-near-tip-getblock-test9
+#   ref: feat/websocket-support
+
+name: Publish to Docker Hub
+
+concurrency:
+  group: dockerhub-publish-${{ github.event.inputs.tag }}
+  cancel-in-progress: false
+
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image tag to push (e.g. pin-near-tip-getblock-test9)"
+        required: true
+        type: string
+      ref:
+        description: "Git ref to build (branch, tag, or SHA)"
+        required: true
+        default: "feat/websocket-support"
+        type: string
+      platforms:
+        description: "Target platforms"
+        required: false
+        default: "linux/amd64"
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+          fetch-depth: 1
+
+      - name: Set build metadata
+        id: meta
+        run: |
+          set -euo pipefail
+          SHA="$(git rev-parse HEAD)"
+          SHORT="$(git rev-parse --short HEAD)"
+          echo "sha=${SHA}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${SHORT}" >> "$GITHUB_OUTPUT"
+          echo "Building ref=${{ inputs.ref }} sha=${SHORT} → docker.io/linkpool/erpc:${{ inputs.tag }}"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          platforms: ${{ inputs.platforms }}
+          tags: |
+            docker.io/linkpool/erpc:${{ inputs.tag }}
+          build-args: |
+            VERSION=${{ inputs.tag }}
+            COMMIT_SHA=${{ steps.meta.outputs.short_sha }}
+          provenance: false
+          sbom: false
+
+      - name: Print digest
+        run: |
+          docker buildx imagetools inspect "docker.io/linkpool/erpc:${{ inputs.tag }}"