diff --git a/flake.lock b/flake.lock
index cf75c92..32fde47 100644
--- a/flake.lock
+++ b/flake.lock
@@ -30,11 +30,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1714475611,
-        "narHash": "sha256-7EmI74Xth23FM9ZDVJe2s/AeW9FqrJw9/b27dIYSvaM=",
+        "lastModified": 1714137143,
+        "narHash": "sha256-LMZjGiacgn0R9zuuolU+XJZsx1hkX5p9gs+d7B0YQCc=",
         "ref": "refs/heads/master",
-        "rev": "e242401553971d5903ae4671bcb395185a81bcd2",
-        "revCount": 5,
+        "rev": "77d432ad8b0e16213b29bbb58e3d73aef0512ee9",
+        "revCount": 3,
         "type": "git",
         "url": "https://git.kun.is/home/blog-pim"
       },
diff --git a/flake.nix b/flake.nix
index 2de4b25..50ad703 100644
--- a/flake.nix
+++ b/flake.nix
@@ -21,5 +21,6 @@
     ./blog-pim.nix
     ./forgejo-nix-action.nix
     ./atticd.nix
+    ./release.nix
   ];
 }
diff --git a/release.nix b/release.nix
new file mode 100644
index 0000000..ba68cc9
--- /dev/null
+++ b/release.nix
@@ -0,0 +1,19 @@
+{ nixpkgs, flutils, ... }: flutils.lib.eachDefaultSystem (system:
+let
+  pkgs = nixpkgs.legacyPackages.${system};
+  createScript = name: runtimeInputs: scriptPath:
+    let
+      script = (pkgs.writeScriptBin name (builtins.readFile scriptPath)).overrideAttrs (old: {
+        buildCommand = "${old.buildCommand}\n patchShebangs $out";
+      });
+    in
+    pkgs.symlinkJoin {
+      inherit name;
+      paths = [ script ] ++ runtimeInputs;
+      buildInputs = [ pkgs.makeWrapper ];
+      postBuild = "wrapProgram $out/bin/${name} --set PATH $out/bin";
+    };
+in
+{
+  packages.release = createScript "release" (with pkgs; [ nix docker-client git ]) ./release.sh;
+})
diff --git a/release.sh b/release.sh
new file mode 100755
index 0000000..7d93be7
--- /dev/null
+++ b/release.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+IFS=$'\n\t'
+
+flakeref="${1-}"
+name="${2-}"
+gitdir="${3:-.}"
+
+if [ -z "$flakeref" ] || [ -z "$name" ];
+  then
+    echo "Usage: $0 FLAKEREF NAME [GITDIR]"
+    exit 1
+fi
+
+imagename=$(nix eval --no-allow-dirty --raw $flakeref.imageName)
+imagetag=$(nix eval --no-allow-dirty --raw $flakeref.imageTag)
+image=$(nix build --no-allow-dirty $flakeref --print-out-paths --no-link)
+gitrev=$(git --git-dir $gitdir/.git --work-tree $gitdir rev-parse HEAD)
+
+docker load < $image
+docker tag $imagename:$imagetag git.kun.is/home/$name:$gitrev
+docker tag $imagename:$imagetag git.kun.is/home/$name:latest
+docker push git.kun.is/home/$name:$gitrev
+docker push git.kun.is/home/$name:latest