diff --git a/.github/workflows/publish-ghcr-container.yaml b/.github/workflows/publish-ghcr-container.yaml
index 7e3f860b..a098e1f3 100644
--- a/.github/workflows/publish-ghcr-container.yaml
+++ b/.github/workflows/publish-ghcr-container.yaml
@@ -5,6 +5,8 @@ on:
       - master
     tags:
       - '*'
+      # publish-tzdata.yaml builds these tags from a published image
+      - '!*-tzdata*'
 
 env:
   REGISTRY: ghcr.io
diff --git a/.github/workflows/publish-tzdata.yaml b/.github/workflows/publish-tzdata.yaml
new file mode 100644
index 00000000..42807d5d
--- /dev/null
+++ b/.github/workflows/publish-tzdata.yaml
@@ -0,0 +1,58 @@
+name: Publish tzdata rebuilds on ghcr.io
+# Rebuilds a published image with a newer tzdata only (wiremind/tzdata/Dockerfile).
+# The image takes the name of the tag, e.g. 4.0-wiremind0-tzdata2026e gives spilo-17:4.0-wiremind0-tzdata2026e.
+on:
+  push:
+    tags:
+      - '*-tzdata*'
+
+env:
+  IMAGE: ghcr.io/${{ github.repository }}-17:${{ github.ref_name }}
+
+jobs:
+  publish:
+    name: Build, test and push the tzdata rebuild
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: 'read'
+      packages: 'write'
+    defaults:
+      run:
+        shell: bash
+    steps:
+    - name: Checkout
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+    - name: Set up packages
+      run: sudo apt-get install -y docker-compose
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+    - name: Login to GHCR
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Build and export to local docker for testing
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      with:
+        context: "wiremind/tzdata/"
+        load: true
+        tags: ${{ env.IMAGE }}
+
+    - name: Test spilo docker image
+      env:
+        SPILO_TEST_IMAGE: ${{ env.IMAGE }}
+      run: |
+        bash postgres-appliance/tests/test_spilo.sh
+
+    - name: Push the image to ghcr
+      uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      with:
+        context: "wiremind/tzdata/"
+        push: true
+        tags: ${{ env.IMAGE }}
+        platforms: linux/amd64
diff --git a/wiremind/tzdata/Dockerfile b/wiremind/tzdata/Dockerfile
new file mode 100644
index 00000000..867130bb
--- /dev/null
+++ b/wiremind/tzdata/Dockerfile
@@ -0,0 +1,34 @@
+# spilo-17:4.0-wiremind0 with a newer tzdata, and nothing else.
+# PostgreSQL reads /usr/share/zoneinfo (the PGDG packages use --with-system-tzdata), so the tzdata
+# package is the only change: PostgreSQL, Patroni, glibc and ICU stay identical (no REINDEX).
+# A rebuild from postgres-appliance/ would also upgrade PostgreSQL, glibc and about 250 other packages.
+ARG BASE_IMAGE=ghcr.io/wiremind/spilo-17:4.0-wiremind0@sha256:78051f58e1b08a9da5656901ab5d62562d20e0f77b9930360c0d9e2fe4258ab5
+FROM ${BASE_IMAGE}
+
+ARG BASE_IMAGE
+# tzdata 2026e has the Manitoba rule. On 2026-10-08 it is only in jammy-proposed: set
+# TZDATA_POCKET=jammy-updates when Ubuntu publishes it there.
+ARG TZDATA_VERSION=2026e-0ubuntu0.22.04.1
+ARG TZDATA_POCKET=jammy-proposed
+
+# The build fails if another package changes, if a rule is missing, or if /etc/localtime moves.
+RUN set -eux; \
+    dpkg-query -W -f='${Package} ${Version}\n' > /tmp/packages-before; \
+    if [ "${TZDATA_POCKET}" != "jammy-updates" ]; then \
+        echo "deb http://archive.ubuntu.com/ubuntu/ ${TZDATA_POCKET} main" > /etc/apt/sources.list.d/tzdata.list; \
+    fi; \
+    apt-get update; \
+    DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends --only-upgrade "tzdata=${TZDATA_VERSION}"; \
+    rm -f /etc/apt/sources.list.d/tzdata.list; \
+    rm -rf /var/lib/apt/lists/*; \
+    dpkg-query -W -f='${Package} ${Version}\n' > /tmp/packages-after; \
+    test "$(diff /tmp/packages-before /tmp/packages-after | grep -c '^[<>]')" -eq 2; \
+    grep -qx "tzdata ${TZDATA_VERSION}" /tmp/packages-after; \
+    rm /tmp/packages-before /tmp/packages-after; \
+    test "$(TZ=America/Vancouver date -d '2027-02-13 12:00 UTC' +%H:%M)" = "05:00"; \
+    test "$(TZ=America/Edmonton date -d '2027-02-13 12:00 UTC' +%H:%M)" = "06:00"; \
+    test "$(TZ=America/Winnipeg date -d '2027-02-13 12:00 UTC' +%H:%M)" = "07:00"; \
+    test "$(readlink -f /etc/localtime)" = "/usr/share/zoneinfo/Etc/UTC"
+
+LABEL org.opencontainers.image.base.name="${BASE_IMAGE}" \
+      org.opencontainers.image.description="spilo-17:4.0-wiremind0 with tzdata ${TZDATA_VERSION}"