diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c2a97ddd8..257d4ccf6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -106,3 +106,43 @@ jobs:
         with:
           name: release-packages
           path: ./release-packages
+
+  docker-amd64:
+    runs-on: ubuntu-latest
+    needs: linux-amd64
+    steps:
+      - uses: actions/checkout@v1
+      - name: Download release package
+        uses: actions/download-artifact@v2
+        with:
+          name: release-packages
+          path: ./release-packages
+      - name: Run ./ci/steps/build-docker-image.sh
+        uses: ./ci/container
+        with:
+          args: ./ci/steps/build-docker-image.sh
+      - name: Upload release image
+        uses: actions/upload-artifact@v2
+        with:
+          name: release-images
+          path: ./release-images
+
+  docker-arm64:
+    runs-on: ubuntu-arm64-latest
+    needs: linux-arm64
+    steps:
+      - uses: actions/checkout@v1
+      - name: Download release package
+        uses: actions/download-artifact@v2
+        with:
+          name: release-packages
+          path: ./release-packages
+      - name: Run ./ci/steps/build-docker-image.sh
+        uses: ./ci/container
+        with:
+          args: ./ci/steps/build-docker-image.sh
+      - name: Upload release image
+        uses: actions/upload-artifact@v2
+        with:
+          name: release-images
+          path: ./release-images
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 4230a9959..2bb7df095 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -13,29 +13,19 @@ jobs:
         uses: ./ci/container
         with:
           args: ./ci/steps/publish-npm.sh
-          env:
-            NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
-  docker-amd64:
+  docker:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v1
-      - name: Run ./ci/steps/publish-docker.sh
+      - name: Run ./ci/steps/push-docker-manifest.sh
         uses: ./ci/container
         with:
-          args: ./ci/steps/publish-docker.sh
-          env:
-            DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-            DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-
-  docker-arm64:
-    runs-on: ubuntu-arm64-latest
-    steps:
-      - uses: actions/checkout@v1
-      - name: Run ./ci/steps/publish-docker.sh
-        uses: ./ci/container
-        with:
-          args: ./ci/steps/publish-docker.sh
-          env:
-            DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-            DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          args: ./ci/steps/push-docker-manifest.sh
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.gitignore b/.gitignore
index 35daca8b0..f171c575b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,4 +6,5 @@ release/
 release-static/
 release-packages/
 release-gcp/
+release-images/
 node_modules
diff --git a/ci/README.md b/ci/README.md
index 7429b8c22..c3f4f86af 100644
--- a/ci/README.md
+++ b/ci/README.md
@@ -21,8 +21,7 @@ Make sure you have `$GITHUB_TOKEN` set and [hub](https://github.com/github/hub)
 7. Publish the release
    1. CI will automatically grab the artifacts and then
       1. Publish the NPM package
-      2. Publish the AMD64 docker image
-      3. Publish the ARM64 docker image
+      2. Publish the Docker Hub image
 8. Update the homebrew and AUR packages
 
 ## dev
@@ -100,10 +99,8 @@ You can disable minification by setting `MINIFY=`.
 This directory contains the release docker container.
 
 - [./release-container/build.sh](./release-container/build.sh)
-  - Builds the release container
+  - Builds the release container with the tag `codercom/code-server:$VERSION-$ARCH`
   - Assumes debian releases are ready in `./release-packages`
-- [./release-container/push.sh](./release-container/push.sh)
-  - Pushes the built release container to docker hub and updates the latest tag
 
 ## container
 
@@ -129,7 +126,9 @@ Just helps avoid clobbering the CI configuration.
   - Contains helpers to download artifacts from github actions workflow runs
 - [./steps/publish-npm.sh](./steps/publish-npm.sh)
   - Grabs the `npm-package` release artifact for the current commit and publishes it on NPM
-- [./steps/publish-docker.sh](./steps/publish-docker.sh)
-  - Grabs the `release-packages` release artifact for the current commit and
-    builds a docker image with it and publishes that onto docker hub with the
-    correct tag and updates latest
+- [./steps/build-docker-image.sh](./steps/build-docker-image.sh)
+  - Builds the docker image and then saves it into `./release-images/$ARCH.tar`
+- [./steps/push-docker-manifest.sh](./steps/push-docker-manifest.sh)
+  - Loads all images in `./release-images` and then builds and pushes a multi architecture
+    docker manifest for the amd64 and arm64 images to `codercom/code-server:$VERSION` and
+    `codercom/code-server:latest`
diff --git a/ci/build/build-packages.sh b/ci/build/build-packages.sh
index f08076676..95b0e0aec 100755
--- a/ci/build/build-packages.sh
+++ b/ci/build/build-packages.sh
@@ -8,25 +8,16 @@ main() {
   cd "$(dirname "${0}")/../.."
   source ./ci/lib.sh
 
-  export VERSION
-  VERSION="$(pkg_json_version)"
-
-  local OS
-  OS="$(os)"
-
-  export ARCH
-  ARCH="$(arch)"
-
-  local archive_name="code-server-$VERSION-$OS-$ARCH"
+  local release_name="code-server-$VERSION-$OS-$ARCH"
   mkdir -p release-packages
 
   if [[ $OS == "linux" ]]; then
-    tar -czf "release-packages/$archive_name.tar.gz" --transform "s/^\.\/release-static/$archive_name/" ./release-static
+    tar -czf "release-packages/$release_name.tar.gz" --transform "s/^\.\/release-static/$release_name/" ./release-static
   else
-    tar -czf "release-packages/$archive_name.tar.gz" -s "/^release-static/$archive_name/" release-static
+    tar -czf "release-packages/$release_name.tar.gz" -s "/^release-static/$release_name/" release-static
   fi
 
-  echo "done (release-packages/$archive_name)"
+  echo "done (release-packages/$release_name)"
 
   release_gcp
 
@@ -37,9 +28,9 @@ main() {
 
 release_gcp() {
   mkdir -p "release-gcp/$VERSION"
-  cp "release-packages/$archive_name.tar.gz" "./release-gcp/$VERSION/$OS-$ARCH.tar.gz"
+  cp "release-packages/$release_name.tar.gz" "./release-gcp/$VERSION/$OS-$ARCH.tar.gz"
   mkdir -p "release-gcp/latest"
-  cp "./release-packages/$archive_name.tar.gz" "./release-gcp/latest/$OS-$ARCH.tar.gz"
+  cp "./release-packages/$release_name.tar.gz" "./release-gcp/latest/$OS-$ARCH.tar.gz"
 }
 
 # Generates deb and rpm packages.
diff --git a/ci/build/build-release.sh b/ci/build/build-release.sh
index 8f61de425..9acacd3ac 100755
--- a/ci/build/build-release.sh
+++ b/ci/build/build-release.sh
@@ -8,7 +8,7 @@ MINIFY="${MINIFY-true}"
 
 main() {
   cd "$(dirname "${0}")/../.."
-  source ./ci/build/lib.sh
+  source ./ci/lib.sh
 
   VSCODE_SRC_PATH="lib/vscode"
   VSCODE_OUT_PATH="$RELEASE_PATH/lib/vscode"
diff --git a/ci/build/build-static-release.sh b/ci/build/build-static-release.sh
index a0242971c..69075579c 100755
--- a/ci/build/build-static-release.sh
+++ b/ci/build/build-static-release.sh
@@ -3,7 +3,7 @@ set -euo pipefail
 
 main() {
   cd "$(dirname "${0}")/../.."
-  source ./ci/build/lib.sh
+  source ./ci/lib.sh
 
   rsync "$RELEASE_PATH/" "$RELEASE_PATH-static"
   RELEASE_PATH+=-static
diff --git a/ci/build/lib.sh b/ci/build/lib.sh
deleted file mode 100755
index f263adb85..000000000
--- a/ci/build/lib.sh
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-source ./ci/lib.sh
-
-# RELEASE_PATH is the destination directory for the release from the root.
-# Defaults to release
-RELEASE_PATH="${RELEASE_PATH-release}"
-
-rsync() {
-  command rsync -a --del "$@"
-}
diff --git a/ci/build/release-github-assets.sh b/ci/build/release-github-assets.sh
index 5f29b4b04..2388aad82 100755
--- a/ci/build/release-github-assets.sh
+++ b/ci/build/release-github-assets.sh
@@ -15,7 +15,7 @@ main() {
   for i in "${!assets[@]}"; do
     assets[$i]="--attach=${assets[$i]}"
   done
-  EDITOR=true hub release edit --draft "${assets[@]}" "v$(pkg_json_version)"
+  EDITOR=true hub release edit --draft "${assets[@]}" "v$VERSION"
 }
 
 main "$@"
diff --git a/ci/build/release-github-draft.sh b/ci/build/release-github-draft.sh
index fcd8e9594..ef552437a 100755
--- a/ci/build/release-github-draft.sh
+++ b/ci/build/release-github-draft.sh
@@ -9,8 +9,8 @@ main() {
 
   hub release create \
     --file - \
-    --draft "${assets[@]}" "v$(pkg_json_version)" << EOF
-v$(pkg_json_version)
+    --draft "${assets[@]}" "v$VERSION" << EOF
+v$VERSION
 
 VS Code v$(vscode_version)
 
diff --git a/ci/container/Dockerfile b/ci/container/Dockerfile
index 87578576e..a609ae8a2 100644
--- a/ci/container/Dockerfile
+++ b/ci/container/Dockerfile
@@ -34,8 +34,10 @@ RUN curl -sSL https://github.com/koalaman/shellcheck/releases/download/v0.7.1/sh
 
 # Install Go dependencies
 RUN ARCH="$(dpkg --print-architecture)" && \
-    curl -sSL "https://dl.google.com/go/go1.14.2.linux-$ARCH.tar.gz" | tar -C /usr/local -xz
+    curl -sSL "https://dl.google.com/go/go1.14.3.linux-$ARCH.tar.gz" | tar -C /usr/local -xz
 ENV PATH=/usr/local/go/bin:/root/go/bin:$PATH
 ENV GO111MODULE=on
 RUN go get mvdan.cc/sh/v3/cmd/shfmt
 RUN go get github.com/goreleaser/nfpm/cmd/nfpm
+
+RUN curl -fsSL https://get.docker.com | sh
diff --git a/ci/lib.sh b/ci/lib.sh
index 3772e1396..a8b4d2e8e 100755
--- a/ci/lib.sh
+++ b/ci/lib.sh
@@ -75,6 +75,21 @@ download_artifact() {
   tmp_file="$(mktemp)"
 
   curl -sSL "$(get_artifact_url "$artifact_name")" > "$tmp_file"
-  unzip -o "$tmp_file" -d "$dst"
+  unzip -q -o "$tmp_file" -d "$dst"
   rm "$tmp_file"
 }
+
+rsync() {
+  command rsync -a --del "$@"
+}
+
+VERSION="$(pkg_json_version)"
+export VERSION
+ARCH="$(arch)"
+export ARCH
+OS=$(os)
+export OS
+
+# RELEASE_PATH is the destination directory for the release from the root.
+# Defaults to release
+RELEASE_PATH="${RELEASE_PATH-release}"
diff --git a/ci/release-container/Dockerfile b/ci/release-container/Dockerfile
index 4dbc4784e..d81dec139 100644
--- a/ci/release-container/Dockerfile
+++ b/ci/release-container/Dockerfile
@@ -35,7 +35,7 @@ RUN ARCH="$(dpkg --print-architecture)" && \
     printf "user: coder\ngroup: coder\n" > /etc/fixuid/config.yml
 
 COPY release-packages/code-server*.deb /tmp/
-RUN dpkg -i /tmp/code-server*-$(dpkg --print-architecture).deb && rm /tmp/code-server*.deb
+RUN dpkg -i /tmp/code-server*$(dpkg --print-architecture).deb && rm /tmp/code-server*.deb
 
 EXPOSE 8080
 USER coder
diff --git a/ci/release-container/build.sh b/ci/release-container/build.sh
index 27941a9b3..e91ea33c5 100755
--- a/ci/release-container/build.sh
+++ b/ci/release-container/build.sh
@@ -4,11 +4,8 @@ set -euo pipefail
 main() {
   cd "$(dirname "$0")/../.."
   source ./ci/lib.sh
-  VERSION="$(pkg_json_version)"
 
-  imageTag="codercom/code-server:$VERSION"
-
-  docker build -t "$imageTag" -f ./ci/release-container/Dockerfile .
+  docker build -t "codercom/code-server-$ARCH:$VERSION" -f ./ci/release-container/Dockerfile .
 }
 
 main "$@"
diff --git a/ci/release-container/push.sh b/ci/release-container/push.sh
deleted file mode 100755
index 0e44a4e4e..000000000
--- a/ci/release-container/push.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-main() {
-  cd "$(dirname "$0")/../.."
-  source ./ci/lib.sh
-  VERSION="$(pkg_json_version)"
-
-  imageTag="codercom/code-server:$VERSION"
-
-  docker push "$imageTag"
-  docker tag "$imageTag" codercom/code-server:latest
-  docker push codercom/code-server:latest
-}
-
-main "$@"
diff --git a/ci/steps/build-docker-image.sh b/ci/steps/build-docker-image.sh
new file mode 100755
index 000000000..c93443544
--- /dev/null
+++ b/ci/steps/build-docker-image.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+main() {
+  cd "$(dirname "$0")/../.."
+  source ./ci/lib.sh
+
+  ./ci/release-container/build.sh
+
+  mkdir -p release-images
+  docker save "codercom/code-server-$ARCH:$VERSION" > "release-images/code-server-$ARCH:$VERSION.tar"
+}
+
+main "$@"
diff --git a/ci/steps/publish-docker.sh b/ci/steps/publish-docker.sh
deleted file mode 100755
index 12bf81110..000000000
--- a/ci/steps/publish-docker.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-main() {
-  cd "$(dirname "$0")/../.."
-  source ./ci/lib.sh
-
-  if [[ ${CI-} ]]; then
-    echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
-  fi
-
-  download_artifact release-packages ./release-packages
-  ./ci/release-container/build.sh
-  ./ci/release-container/push.sh
-}
-
-main "$@"
diff --git a/ci/steps/push-docker-manifest.sh b/ci/steps/push-docker-manifest.sh
new file mode 100755
index 000000000..08d0fdacf
--- /dev/null
+++ b/ci/steps/push-docker-manifest.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+main() {
+  cd "$(dirname "$0")/../.."
+  source ./ci/lib.sh
+
+  download_artifact release-images ./release-images
+  if [[ ${CI-} ]]; then
+    echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+  fi
+
+  for img in ./release-images/*; do
+    docker load -i "$img"
+  done
+
+  # We have to ensure the amd64 and arm64 images exist on the remote registry
+  # in order to build the manifest.
+  # We don't put the arch in the tag to avoid polluting the main repository.
+  # These other repositories are private so they don't pollute our organization namespace.
+  docker push "codercom/code-server-amd64:$VERSION"
+  docker push "codercom/code-server-arm64:$VERSION"
+
+  export DOCKER_CLI_EXPERIMENTAL=enabled
+
+  docker manifest create "codercom/code-server:$VERSION" \
+    "codercom/code-server-amd64:$VERSION" \
+    "codercom/code-server-arm64:$VERSION"
+  docker manifest push --purge "codercom/code-server:$VERSION"
+
+  docker manifest create "codercom/code-server:latest" \
+    "codercom/code-server-amd64:$VERSION" \
+    "codercom/code-server-arm64:$VERSION"
+  docker manifest push --purge "codercom/code-server:latest"
+}
+
+main "$@"
diff --git a/package.json b/package.json
index fbb114c93..1a22371f8 100644
--- a/package.json
+++ b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "code-server",
   "license": "MIT",
-  "version": "3.3.0",
+  "version": "3.3.0-rc.28",
   "description": "Run VS Code on a remote server.",
   "homepage": "https://github.com/cdr/code-server",
   "bugs": {