diff --git a/.circleci/config.yml b/.circleci/config.yml
index c3351e40e5..8fa8c3451e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -129,26 +129,22 @@ jobs:
       - run: go install github.com/google/ko@latest
       - checkout
       - setup_remote_docker
-      - run: ./build-docker.sh
-      - run: mkdir -p ~/images
-      - run: docker save honeycombio/refinery | gzip > ~/images/refinery.tar.gz
-      - persist_to_workspace:
-          root: ~/
-          paths:
-            - images
-      - store_artifacts:
-          path: ~/images
+      - run:
+          name: build docker images and publish locally
+          command: ./build-docker.sh
 
   publish_docker:
     docker:
-      - image: cimg/base:stable
+      - image: cimg/go:1.16
     steps:
-      - attach_workspace:
-          at: ~/
+      - run: go install github.com/google/ko@latest
+      - checkout
       - setup_remote_docker
-      - run: docker load -i ~/images/refinery.tar.gz
-      - run: echo "${DOCKER_PASSWORD}" | docker login -u "${DOCKER_USERNAME}" --password-stdin;
-      - run: docker image push -a honeycombio/refinery
+      - run:
+          name: build docker images and publish to Docker Hub
+          environment:
+            KO_DOCKER_REPO: honeycombio
+          command: ./build-docker.sh
 
 workflows:
   build:
@@ -173,6 +169,7 @@ workflows:
           context: Honeycomb Secrets for Public Repos
           requires:
             - build_binaries
+            - build_docker
           filters:
             tags:
               only: /^v.*/
@@ -182,6 +179,7 @@ workflows:
           context: Honeycomb Secrets for Public Repos
           requires:
             - build_binaries
+            - build_docker
           filters:
             tags:
               only: /^v.*/
@@ -190,6 +188,7 @@ workflows:
       - publish_docker:
           context: Honeycomb Secrets for Public Repos
           requires:
+            - build_binaries
             - build_docker
           filters:
             tags:
diff --git a/build-docker.sh b/build-docker.sh
index 5d96459106..c27a5091dd 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -13,7 +13,7 @@ fi
 
 unset GOOS
 unset GOARCH
-export KO_DOCKER_REPO="ko.local"
+export KO_DOCKER_REPO=${KO_DOCKER_REPO:-ko.local}
 export GOFLAGS="-ldflags=-X=main.BuildID=$VERSION"
 export SOURCE_DATE_EPOCH=$(date +%s)
 # shellcheck disable=SC2086
@@ -22,9 +22,3 @@ ko publish \
   --base-import-paths \
   --platform "linux/amd64,linux/arm64" \
   ./cmd/refinery
-
-# update tags to use correct org name
-for TAG in ${TAGS//,/ }
-do
-    docker image tag ko.local/refinery honeycombio/refinery:$TAG
-done