diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d165560..784bb8b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -34,15 +34,25 @@ jobs:
             echo "IMAGE_TAG=$BRANCH" >> "$GITHUB_ENV"
           fi
       -
-        name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      -
-        name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        name: Extract metadata for Docker (tags, labels)
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: |
+            ${{ secrets.DOCKERHUB_USERNAME }}/free-games-claimer
+            ghcr.io/${{ github.actor }}/free-games-claimer
+          tags: |
+            type=ref,event=branch
+            type=ref,event=pr
+            # use docker tag 'latest' for the default branch (default is to only use it for the latest git tag)
+            type=raw,value=latest,enable={{is_default_branch}}
+          labels: |
+            org.opencontainers.image.created={{commit_date 'YYYY-MM-DDTHH:mm:ss.SSS[Z]'}}
       -
         name: Login to Docker Hub
         uses: docker/login-action@v3
         # if: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }} # does not work: Unrecognized named-value: 'secrets' - https://www.cloudtruth.com/blog/skipping-jobs-in-github-actions-when-secrets-are-unavailable-securely-inject-configuration-secrets-into-github
+        if: github.event_name != 'pull_request' # don't try to login since PRs don't have access to secrets and need to set them in their fork
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -53,20 +63,31 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }} # actor is user that opened PR, was repository_owner before
           password: ${{ secrets.GITHUB_TOKEN }}
+      -
+        name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
       -
         name: Build and push
         uses: docker/build-push-action@v6
         if: ${{ env.IMAGE_TAG != '' }}
         with:
           context: .
-          push: ${{ secrets.DOCKERHUB_USERNAME != '' }}
+          # push: ${{ github.event_name != 'pull_request' }}
+          push: ${{ secrets.DOCKERHUB_USERNAME != '' }} # here we can access secrets
+          # TODO speed up by building in parallel? https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
+          platforms: linux/amd64,linux/arm64
           build-args: |
             COMMIT=${{ github.sha }}
             BRANCH=${{ env.BRANCH }}
             NOW=${{ env.NOW }}
-          platforms: linux/amd64,linux/arm64
-          tags: |
-            ${{ secrets.DOCKERHUB_USERNAME }}/free-games-claimer:${{env.IMAGE_TAG}}
-            ghcr.io/${{ github.actor }}/free-games-claimer:${{env.IMAGE_TAG}}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          annotations: ${{ steps.meta.outputs.annotations }}
+          # tags: |
+          #   ${{ secrets.DOCKERHUB_USERNAME }}/free-games-claimer:${{env.IMAGE_TAG}}
+          #   ghcr.io/${{ github.actor }}/free-games-claimer:${{env.IMAGE_TAG}}
           cache-from: type=gha
           cache-to: type=gha,mode=max
diff --git a/Dockerfile b/Dockerfile
index e2f8006..431ec83 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -75,14 +75,14 @@ ENV BRANCH=${BRANCH}
 ENV NOW=${NOW}
 
 LABEL org.opencontainers.image.title="free-games-claimer" \
-      org.opencontainers.image.name="free-games-claimer" \
+      # org.opencontainers.image.name="free-games-claimer" \
       org.opencontainers.image.description="Automatically claims free games on the Epic Games Store, Amazon Prime Gaming and GOG" \
       org.opencontainers.image.url="https://github.com/vogler/free-games-claimer" \
-      org.opencontainers.image.source="https://github.com/vogler/free-games-claimer" \
-      org.opencontainers.image.revision=${COMMIT} \
-      org.opencontainers.image.ref.name=${BRANCH} \
-      org.opencontainers.image.base.name="ubuntu:jammy" \
-      org.opencontainers.image.version="latest"
+      org.opencontainers.image.source="https://github.com/vogler/free-games-claimer"
+      # org.opencontainers.image.revision=${COMMIT} \
+      # org.opencontainers.image.ref.name=${BRANCH} \
+      # org.opencontainers.image.base.name="ubuntu:jammy" \
+      # org.opencontainers.image.version="latest"
 
 # Configure VNC via environment variables:
 ENV VNC_PORT 5900