diff --git a/.github/workflows/build-image.yml b/.github/workflows/build-image.yml
index 16c18c8a..3d6a089f 100644
--- a/.github/workflows/build-image.yml
+++ b/.github/workflows/build-image.yml
@@ -9,6 +9,12 @@ on:
         type: string
   push:
     tags: ["v*"]
+    branches: ["canary"]
+
+# One active run per ref (e.g. canary); newer runs cancel older in-progress builds.
+concurrency:
+  group: build-image-${{ github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
@@ -52,7 +58,9 @@ jobs:
 
           OWNER="${GITHUB_REPOSITORY_OWNER,,}"
 
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+          if [[ "${GITHUB_REF}" == refs/heads/canary ]]; then
+            VERSION="canary"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
             VERSION="${GITHUB_REF_NAME}"
           elif [[ -n "$INPUT_VERSION" ]]; then
             VERSION="$INPUT_VERSION"
@@ -135,7 +143,9 @@ jobs:
 
           OWNER="${GITHUB_REPOSITORY_OWNER,,}"
 
-          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+          if [[ "${GITHUB_REF}" == refs/heads/canary ]]; then
+            VERSION="canary"
+          elif [[ "${GITHUB_REF}" == refs/tags/* ]]; then
             VERSION="${GITHUB_REF_NAME}"
           elif [[ -n "$INPUT_VERSION" ]]; then
             VERSION="$INPUT_VERSION"
@@ -181,16 +191,23 @@ jobs:
             exit 1
           fi
 
-          if [[ "${VERSION}" =~ (alpha|beta|rc) ]]; then
-            FLOATING_TAG="beta"
+          # canary builds only publish the movable :canary tag (not latest/beta)
+          if [[ "${VERSION}" == "canary" ]]; then
+            docker buildx imagetools create \
+              -t "${IMAGE}:canary" \
+              "${references[@]}"
           else
-            FLOATING_TAG="latest"
-          fi
+            if [[ "${VERSION}" =~ (alpha|beta|rc) ]]; then
+              FLOATING_TAG="beta"
+            else
+              FLOATING_TAG="latest"
+            fi
 
-          docker buildx imagetools create \
-            -t "${IMAGE}:${VERSION}" \
-            -t "${IMAGE}:${FLOATING_TAG}" \
-            "${references[@]}"
+            docker buildx imagetools create \
+              -t "${IMAGE}:${VERSION}" \
+              -t "${IMAGE}:${FLOATING_TAG}" \
+              "${references[@]}"
+          fi
         env:
           IMAGE: ${{ env.IMAGE }}
 
diff --git a/Makefile b/Makefile
index 1ea36dd5..ec1700af 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: swagger license license-check build-embedded build-test cross-build code-check format
+.PHONY: swagger license license-check build-embedded build-test cross-build code-check format canary
 
 VERSION ?= dev
 BUILD_DATE ?= $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
@@ -108,3 +108,38 @@ dev:
 		echo "==> Development servers exited with errors." >&2; \
 		exit 1; \
 	fi
+
+# Merge the current branch into canary and push, triggering Build Image (:canary).
+canary:
+	@set -e; \
+	if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then \
+		echo "error: not a git repository" >&2; \
+		exit 1; \
+	fi; \
+	if [ -n "$$(git status --porcelain)" ]; then \
+		echo "error: working tree is dirty; commit or stash changes first" >&2; \
+		exit 1; \
+	fi; \
+	CURRENT_BRANCH=$$(git rev-parse --abbrev-ref HEAD); \
+	if [ "$$CURRENT_BRANCH" = "HEAD" ]; then \
+		echo "error: detached HEAD; checkout a branch first" >&2; \
+		exit 1; \
+	fi; \
+	echo "==> Publishing $$CURRENT_BRANCH to canary..."; \
+	git fetch origin; \
+	if git show-ref --verify --quiet refs/remotes/origin/canary; then \
+		git checkout -B canary origin/canary; \
+	else \
+		git checkout -B canary; \
+	fi; \
+	if [ "$$CURRENT_BRANCH" != "canary" ]; then \
+		if ! git merge --no-edit "$$CURRENT_BRANCH"; then \
+			echo "error: merge failed; resolve conflicts on canary, then: git push -u origin canary" >&2; \
+			exit 1; \
+		fi; \
+	fi; \
+	git push -u origin canary; \
+	if [ "$$CURRENT_BRANCH" != "canary" ]; then \
+		git checkout "$$CURRENT_BRANCH"; \
+	fi; \
+	echo "==> canary updated and pushed (image tag: canary)"
diff --git a/frontend/pnpm-workspace.yaml b/frontend/pnpm-workspace.yaml
index 07399aa0..42ea1c72 100644
--- a/frontend/pnpm-workspace.yaml
+++ b/frontend/pnpm-workspace.yaml
@@ -1,4 +1,6 @@
 allowBuilds:
+  '@parcel/watcher': true
+  '@swc/core': true
   core-js: true
   sharp: true
   unrs-resolver: true