diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 046fb281..eb575d97 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,16 +10,16 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
 
       - name: Log into Docker Hub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Log into GitHub Packages
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -57,8 +57,16 @@ jobs:
           docker push cs50/codespace:${{ github.sha }}
           docker push cs50/codespace:latest
 
-      - name: Build ${{ github.ref_name}}
-        if: ${{ github.ref != 'refs/heads/main' }}
+      - name: Build (canary)
+        if: ${{ github.ref == 'refs/heads/canary' }}
+        run: |
+          export TAG=canary
+          export VCS_REF=$(git rev-parse HEAD)
+          npm install -g @devcontainers/cli
+          devcontainer build --workspace-folder . --config devcontainer.json --image-name cs50/codespace:${{ github.sha }} --image-name cs50/codespace:${{ github.ref_name }}
+
+      - name: Build (${{ github.ref_name}})
+        if: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/canary' }}
         run: |
           export TAG=amd64
           export VCS_REF=$(git rev-parse HEAD)
@@ -86,7 +94,7 @@ jobs:
 
       - name: Tag main as latest
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: actions/github-script@v6
+        uses: actions/github-script@v7
         with:
           github-token: ${{ github.token }}
           script: |