diff --git a/.circleci/config.yml b/.circleci/config.yml
index a1d79dc8..46862f3d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -20,10 +20,10 @@ jobs:
           paths:
             - "/go/pkg/mod/"
       - run: |
-          mkdir workspace
+          mkdir bin
           cp flagger workspace/flagger
       - persist_to_workspace:
-          root: workspace
+          root: bin
           paths:
             - flagger
 
@@ -35,11 +35,11 @@ jobs:
       - setup_remote_docker:
           docker_layer_caching: true
       - attach_workspace:
-          at: /tmp/workspace
+          at: /tmp/bin
       - run: |
-          cp /tmp/workspace/flagger .
+          cp /tmp/bin/flagger .
           chmod +x flagger
-          docker build -t weaveworks/flagger:${CIRCLE_SHA1} . -f ./test/Dockerfile.ci
+      - run: test/container-build.sh
 
   e2e-istio-testing:
     machine: true
diff --git a/test/container-build.sh b/test/container-build.sh
new file mode 100755
index 00000000..2b129f05
--- /dev/null
+++ b/test/container-build.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+
+set -o errexit
+
+cp /tmp/workspace/flagger .
+chmod +x flagger
+
+docker build -t weaveworks/flagger:latest . -f ./test/Dockerfile.ci
+
+BRANCH_COMMIT=${CIRCLE_BRANCH}-$(echo ${CIRCLE_SHA1} | head -c7)
+
+if [[ -z "$DOCKER_PASS" ]]; then
+    echo "No Docker Hub credentials, skipping image push";
+else
+    echo $DOCKER_PASS | docker login -u=$DOCKER_USER --password-stdin;
+    docker tag weaveworks/flagger:latest weaveworks/flagger:${BRANCH_COMMIT};
+    docker push weaveworks/flagger:${BRANCH_COMMIT};
+fi
+
+if [[ -z "$CIRCLE_TAG" ]]; then
+    echo "Not a release, skipping image push";
+else
+    echo $DOCKER_PASS | docker login -u=$DOCKER_USER --password-stdin;
+    docker tag weaveworks/flagger:latest weaveworks/flagger:${CIRCLE_TAG};
+    docker push weaveworks/flagger:${CIRCLE_TAG};
+fi