diff --git a/.build.yml b/.build.yml
index 46d8935..c6e0fad 100644
--- a/.build.yml
+++ b/.build.yml
@@ -2,16 +2,22 @@ image: alpine/edge
 
 secrets:
   - 0f9c437f-5dfc-49f1-abfb-0030f265c018
+  - 4a3f4fc4-428c-4e38-acce-c93a986777b6
 
 packages:
   - docker
+  - perl
   - just
 
 tasks:
   - prep: |
       sudo addgroup build docker
       sudo rc-service docker start
+      sleep 4
   - build: |
       cd alpine-cli
+      perl -nE '$ARGV =~ s/.*\.(.+)/uc($1)/e; chomp; printf qq/%s="%s"\n/,$ARGV, $_;' ~/.env.* > .env
       just build
-
+  - publish: |
+      cd alpine-cli
+      just publish
diff --git a/justfile b/justfile
index 6010f80..daeed14 100644
--- a/justfile
+++ b/justfile
@@ -1,3 +1,5 @@
+set dotenv-load
+
 image := "ghcr.io/jswank/alpine-cli:latest"
 
 # get a bash shell on a temporary container using {{image}}
@@ -10,3 +12,8 @@ run:
 # build a new image
 build:
   docker build -t {{image}} -f Dockerfile ./ctx 
+
+publish:
+  echo $GH_PAT | docker login ghcr.io -u jswank --password-stdin
+  docker push {{image}}
+  docker logout ghcr.io