diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 815c09f8..bd32c6d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,31 +3,51 @@ name: release
 on:
   push:
     tags:
-    - '*'
+      - "*"
 
 jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      -
-        name: Checkout
+      - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      -
-        name: Set up Go
+      - name: Set up Go
         uses: actions/setup-go@v5
         with:
           go-version: 1.19
-      -
-        name: Run GoReleaser
+      - name: Login to ghcr.io registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Log into DockerHub
+        uses: docker/login-action@v3
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+        if: ${{ env.DOCKER_USERNAME != '' }}
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: Log into quay.io
+        uses: docker/login-action@v3
+        env:
+          QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }}
+        if: ${{ env.QUAY_USERNAME != '' }}
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_PASSWORD }}
+      - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
           version: latest
-          args: release --rm-dist
+          args: release --clean
         env:
           # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          # 
+          #
           # Token for robot account @equinix-homebrew-tap, which can publish
           # to metal-cli and homebrew-tap GH repos
           GITHUB_TOKEN: ${{ secrets.GH_HOMEBREW_TAP_TOKEN }}
diff --git a/.goreleaser.yml b/.goreleaser.yml
index c9d7afee..921e7402 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -7,44 +7,44 @@ before:
     # you may remove this if you don't need go generate
     - go generate ./...
 builds:
-- main: ./cmd/metal
-  env:
-  - CGO_ENABLED=0
-  binary: metal
-  ldflags:
-   - -X github.com/equinix/metal-cli/cmd.Version={{.Version}}
-   - -X github.com/equinix/metal-cli/cmd.Build=${.Commit}"
+  - main: ./cmd/metal
+    env:
+      - CGO_ENABLED=0
+    binary: metal
+    ldflags:
+      - -X github.com/equinix/{{ .ProjectName }}/cmd.Version={{.Version}}
+      - -X github.com/equinix/{{ .ProjectName }}/cmd.Build=${.Commit}"
 
-  goos:
-    - freebsd
-    - linux
-    - windows
-    - darwin
-  goarch:
-    - amd64
-    - arm
-    - arm64
-  goarm:
-    - "6"
-    - "7"
+    goos:
+      - freebsd
+      - linux
+      - windows
+      - darwin
+    goarch:
+      - amd64
+      - arm
+      - arm64
+    goarm:
+      - "6"
+      - "7"
 
 archives:
-- format: binary
-  name_template: "{{ .Binary }}-{{ .Os }}-{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
+  - format: binary
+    name_template: "{{ .Binary }}-{{ .Os }}-{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
 checksum:
   name_template: "{{ .ProjectName }}_{{ .Version }}_checksums.txt"
 release:
-  name_template: "{{.ProjectName}}-v{{.Version}}"
+  name_template: "{{ .ProjectName }}-v{{ .Version }}"
 snapshot:
   name_template: "{{ .Tag }}-next"
 changelog:
   sort: asc
   filters:
     exclude:
-    - '^docs:'
-    - '^test:'
+      - "^docs:"
+      - "^test:"
 
-brews: 
+brews:
   - homepage: "https://metal.equinix.com/developers/docs/libraries/cli/"
     description: "Official Equinix Metal CLI"
     license: "MIT"
@@ -54,6 +54,87 @@ brews:
     test: |
       system "#{bin}/metal -v"
     commit_msg_template: "Brew formula update for {{ .ProjectName }} version {{ .Tag }}"
-    tap:
+    repository:
       owner: equinix
       name: homebrew-tap
+
+# ko is a docker image builder that simplifies making multiplatform images.
+# This is much simpler than configuring all the docker ptions in goreleaser.
+# Unfortunately, it doesn't support the scratch image, so we use chainguard's
+# static image as a base.
+kos:
+  - id: dockerhub
+    repository: equinix/{{ .ProjectName }}
+    build: metal-cli
+    base_image: cgr.dev/chainguard/static
+    labels:
+      org.opencontainers.image.base.name: "cgr.dev/chainguard/static"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.name: "{{.ProjectName}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.title: "{{.ProjectName}}"
+      org.opencontainers.image.url: "https://deploy.equinix.com/labs/metal-cli/"
+      org.opencontainers.image.vendor: "Equinix"
+      org.opencontainers.image.version: "{{.Version}}"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+      - linux/arm/v7
+    tags:
+      - latest
+      - "{{ .Tag }}"
+      - "{{ .Major }}"
+      - "{{ .Major }}.{{ .Minor }}"
+    sbom: none
+    bare: true
+  - id: github
+    repository: ghcr.io/equinix/{{ .ProjectName }}
+    build: metal-cli
+    base_image: cgr.dev/chainguard/static
+    labels:
+      org.opencontainers.image.base.name: "cgr.dev/chainguard/static"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.name: "{{.ProjectName}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.title: "{{.ProjectName}}"
+      org.opencontainers.image.url: "https://deploy.equinix.com/labs/metal-cli/"
+      org.opencontainers.image.vendor: "Equinix"
+      org.opencontainers.image.version: "{{.Version}}"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+      - linux/arm/v7
+    tags:
+      - latest
+      - "{{ .Tag }}"
+      - "{{ .Major }}"
+      - "{{ .Major }}.{{ .Minor }}"
+    sbom: none
+    bare: true
+  - id: quay
+    build: metal-cli
+    repository: quay.io/equinix-oss/metal-cli
+    base_image: cgr.dev/chainguard/static
+    labels:
+      org.opencontainers.image.base.name: "cgr.dev/chainguard/static"
+      org.opencontainers.image.created: "{{.Date}}"
+      org.opencontainers.image.name: "{{.ProjectName}}"
+      org.opencontainers.image.revision: "{{.FullCommit}}"
+      org.opencontainers.image.source: "{{.GitURL}}"
+      org.opencontainers.image.title: "{{.ProjectName}}"
+      org.opencontainers.image.url: "https://deploy.equinix.com/labs/metal-cli/"
+      org.opencontainers.image.vendor: "Equinix"
+      org.opencontainers.image.version: "{{.Version}}"
+    platforms:
+      - linux/amd64
+      - linux/arm64
+      - linux/arm/v7
+    tags:
+      - latest
+      - "{{ .Tag }}"
+      - "{{ .Major }}"
+      - "{{ .Major }}.{{ .Minor }}"
+    sbom: none
+    bare: true