diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 7f5ef322da..2780fc437f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -19,7 +19,7 @@ variables:
   G_MESSAGES_DEBUG: all
 
 fedora-x86_64:
-  image: registry.gitlab.gnome.org/gnome/gtk/master:v10
+  image: registry.gitlab.gnome.org/gnome/gtk/fedora:v11
   stage: build
   variables:
     EXTRA_MESON_FLAGS: "--buildtype=debug --default-library=both"
@@ -62,7 +62,7 @@ fedora-x86_64:
     <<: *cache-paths
 
 fedora-x86_64-release:
-  image: registry.gitlab.gnome.org/gnome/gtk/master:v10
+  image: registry.gitlab.gnome.org/gnome/gtk/fedora:v11
   stage: build
   variables:
     EXTRA_MESON_FLAGS: "--buildtype=release"
@@ -144,11 +144,12 @@ flatpak-master:icon-browser:
   <<: *flatpak-master
 
 pages:
-  image: registry.gitlab.gnome.org/gnome/gtk/master:v10
+  image: registry.gitlab.gnome.org/gnome/gtk/fedora:v11
   stage: deploy
+  variables:
+    EXTRA_MESON_FLAGS: "--buildtype=release"
   script:
-    - meson -Dgtk_doc=true _build .
-    - ninja -C _build
+    - meson ${COMMON_MESON_FLAGS} -Dgtk_doc=true _build
     - ninja -C _build gdk4-doc gsk4-doc gtk4-doc
     - mkdir -p public/
     - mv _build/docs/reference/gtk/html/ public/gtk/
diff --git a/.gitlab-ci/README.md b/.gitlab-ci/README.md
new file mode 100644
index 0000000000..3958faf001
--- /dev/null
+++ b/.gitlab-ci/README.md
@@ -0,0 +1,38 @@
+## GTK CI infrastructure
+
+GTK uses different CI images depending on platform and jobs.
+
+The CI images are Docker containers, generated either using `docker` or
+`podman`, and pushed to the GitLab [container registry][registry].
+
+Each Docker image has a tag composed of two parts:
+
+ - `${image}`: the base image for a given platform, like "fedora" or
+   "debian-stable"
+ - `${number}`: an incremental version number, or `latest`
+
+See the [container registry][registry] for the available images for each
+branch, as well as their available versions.
+
+### Checklist for Updating a CI image
+
+ - [ ] Update the `${image}.Dockerfile` file with the dependencies
+ - [ ] Run `./run-docker.sh build --base ${image} --base-version ${number}`
+ - [ ] Run `./run-docker.sh push --base ${image} --base-version ${number}`
+   once the Docker image is built; you may need to log in by using
+   `docker login` or `podman login`
+ - [ ] Update the `image` keys in the `.gitlab-ci.yml` file with the new
+   image tag
+ - [ ] Open a merge request with your changes and let it run
+
+### Checklist for Adding a new CI image
+
+ - [ ] Write a new `${image}.Dockerfile` with the instructions to set up
+   a build environment
+ - [ ] Add the `pip3 install meson` incantation
+ - [ ] Run `./run-docker.sh build --base ${image} --base-version ${number}`
+ - [ ] Run `./run-docker.sh push --base ${image} --base-version ${number}`
+ - [ ] Add the new job to `.gitlab-ci.yml` referencing the image
+ - [ ] Open a merge request with your changes and let it run
+
+[registry]: https://gitlab.gnome.org/GNOME/gtk/container_registry
diff --git a/.gitlab-ci/fedora.Dockerfile b/.gitlab-ci/fedora.Dockerfile
index a9006c01f2..2490f0a507 100644
--- a/.gitlab-ci/fedora.Dockerfile
+++ b/.gitlab-ci/fedora.Dockerfile
@@ -61,10 +61,10 @@ RUN dnf -y install \
     ninja-build \
     pango-devel \
     pcre-devel \
-    pygments \
     python3 \
     python3-jinja2 \
     python3-pip \
+    python3-pygments \
     python3-wheel \
     redhat-rpm-config \
     sassc \
diff --git a/.gitlab-ci/run-docker.sh b/.gitlab-ci/run-docker.sh
index 8a04ce8c89..dc9647bd4b 100755
--- a/.gitlab-ci/run-docker.sh
+++ b/.gitlab-ci/run-docker.sh
@@ -1,11 +1,130 @@
 #!/bin/bash
 
+read_arg() {
+    # $1 = arg name
+    # $2 = arg value
+    # $3 = arg parameter
+    local rematch='^[^=]*=(.*)$'
+    if [[ $2 =~ $rematch ]]; then
+        read "$1" <<< "${BASH_REMATCH[1]}"
+    else
+        read "$1" <<< "$3"
+        # There is no way to shift our callers args, so
+        # return 1 to indicate they should do it instead.
+        return 1
+    fi
+}
+
 set -e
 
-TAG="registry.gitlab.gnome.org/gnome/gtk/master:v10"
+build=0
+run=0
+push=0
+list=0
+print_help=0
+no_login=0
 
-sudo docker build --build-arg HOST_USER_ID="$UID" --tag "${TAG}" \
-    --file "Dockerfile" .
-sudo docker run --rm --security-opt label=disable \
-    --volume "$(pwd)/..:/home/user/app" --workdir "/home/user/app" \
-    --tty --interactive "${TAG}" bash
+while (($# > 0)); do
+        case "${1%%=*}" in
+                build) build=1;;
+                run) run=1;;
+                push) push=1;;
+                list) list=1;;
+                help) print_help=1;;
+                --base|-b) read_arg base "$@" || shift;;
+                --base-version) read_arg base_version "$@" || shift;;
+                --no-login) no_login=1;;
+                *) echo -e "\e[1;31mERROR\e[0m: Unknown option '$1'"; exit 1;;
+        esac
+        shift
+done
+
+if [ $print_help == 1 ]; then
+        echo "$0 - Build and run Docker images"
+        echo ""
+        echo "Usage: $0 <command> [options] [basename]"
+        echo ""
+        echo "Available commands"
+        echo ""
+        echo "  build --base=<BASENAME> - Build Docker image <BASENAME>.Dockerfile"
+        echo "  run --base=<BASENAME>   - Run Docker image <BASENAME>"
+        echo "  push --base=<BASENAME>  - Push Docker image <BASENAME> to the registry"
+        echo "  list                    - List available images"
+        echo "  help                    - This help message"
+        echo ""
+        exit 0
+fi
+
+cd "$(dirname "$0")"
+
+if [ $list == 1 ]; then
+        echo "Available Docker images:"
+        for f in *.Dockerfile; do
+                filename=$( basename -- "$f" )
+                basename="${filename%.*}"
+
+                echo -e "  \e[1;39m$basename\e[0m"
+        done
+        exit 0
+fi
+
+# All commands after this require --base to be set
+if [ -z $base ]; then
+        echo "Usage: $0 <command>"
+        exit 1
+fi
+
+if [ ! -f "$base.Dockerfile" ]; then
+        echo -e "\e[1;31mERROR\e[0m: Dockerfile for '$base' not found"
+        exit 1
+fi
+
+if [ -z $base_version ]; then
+        base_version="latest"
+else
+        base_version="v$base_version"
+fi
+
+TAG="registry.gitlab.gnome.org/gnome/gtk/${base}:${base_version}"
+
+if [ $build == 1 ]; then
+        if docker --help |& grep -q podman; then
+                # Docker is actually implemented by podman, and its OCI output
+                # is incompatible with some of the dockerd instances on GitLab
+                # CI runners.
+                format="--format docker"
+        else
+                format=""
+        fi
+
+        echo -e "\e[1;32mBUILDING\e[0m: ${base} as ${TAG}"
+        sudo docker build \
+                ${format} \
+                --build-arg HOST_USER_ID="$UID" \
+                --tag "${TAG}" \
+                --file "${base}.Dockerfile" .
+        exit $?
+fi
+
+if [ $push == 1 ]; then
+        echo -e "\e[1;32mPUSHING\e[0m: ${base} as ${TAG}"
+
+        if [ $no_login == 0 ]; then
+                sudo docker login registry.gitlab.gnome.org
+        fi
+
+        sudo docker push $TAG
+        exit $?
+fi
+
+if [ $run == 1 ]; then
+        echo -e "\e[1;32mRUNNING\e[0m: ${base} as ${TAG}"
+        sudo docker run \
+                --rm \
+                --volume "$(pwd)/..:/home/user/app" \
+                --workdir "/home/user/app" \
+                --tty \
+                --interactive "${TAG}" \
+                bash
+        exit $?
+fi