diff --git a/.github/workflows/test-build-deploy.yml b/.github/workflows/test-build-deploy.yml
index f5b34189c3a..66d02afa9c4 100644
--- a/.github/workflows/test-build-deploy.yml
+++ b/.github/workflows/test-build-deploy.yml
@@ -20,7 +20,7 @@ jobs:
   lint:
     runs-on: ubuntu-20.04
     container:
-      image: grafana/mimir-build-image:update-go-1.17.8-8a996bb57
+      image: grafana/mimir-build-image:chore-build-multiplatform-images-3b8a0c120
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -50,7 +50,7 @@ jobs:
   lint-jsonnet:
     runs-on: ubuntu-20.04
     container:
-      image: grafana/mimir-build-image:update-go-1.17.8-8a996bb57
+      image: grafana/mimir-build-image:chore-build-multiplatform-images-3b8a0c120
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -81,7 +81,7 @@ jobs:
         test_group_id:    [0, 1, 2, 3]
         test_group_total: [4]
     container:
-      image: grafana/mimir-build-image:update-go-1.17.8-8a996bb57
+      image: grafana/mimir-build-image:chore-build-multiplatform-images-3b8a0c120
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -107,7 +107,7 @@ jobs:
   build-mimir:
     runs-on: ubuntu-20.04
     container:
-      image: grafana/mimir-build-image:update-go-1.17.8-8a996bb57
+      image: grafana/mimir-build-image:chore-build-multiplatform-images-3b8a0c120
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -117,26 +117,27 @@ jobs:
         run: |
           mkdir -p /go/src/github.com/grafana/mimir
           ln -s $GITHUB_WORKSPACE/* /go/src/github.com/grafana/mimir
-      - name: Build Image
-        run: |
-          make BUILD_IN_CONTAINER=false ./cmd/mimir/.uptodate
-      - name: Save Images
+      - name: Build Images
         run: |
-          mkdir /tmp/images
-          ln -s /tmp/images ./docker-images
-          make BUILD_IN_CONTAINER=false save-images
-      - name: Create Docker Images Archive
-        run: tar -cvf mimir-images.tar /tmp/images
-      - name: Upload Docker Images Artifact
+          export GIT_REVISION=$(git rev-parse --short HEAD)
+          export VERSION=$(cat "./VERSION" 2> /dev/null)
+          export GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+          # Configure ko's image creation timestamp to correspond to the commit timestamp
+          export SOURCE_DATE_EPOCH=$(git show -s --format=%ct)
+          export KO_DOCKER_REPO=grafana
+          ko build -B --image-label org.opencontainers.image.title=mimir,org.opencontainers.image.source=https://github.com/grafana/mimir/tree/main/cmd/mimir,org.opencontainers.image.revision=${GIT_REVISION} --oci-layout-path mimir-oci-layout --platform=linux/amd64,linux/arm64 --push=false ./cmd/mimir
+      - name: Create Mimir OCI Image Layout Archive
+        run: tar -cvf mimir-oci-layout.tar mimir-oci-layout
+      - name: Upload Mimir OCI Image Layout
         uses: actions/upload-artifact@v2
         with:
-          name: Docker Images Mimir
-          path: ./mimir-images.tar
+          name: Mimir OCI Image Layout
+          path: ./mimir-oci-layout.tar
 
   build-tools:
     runs-on: ubuntu-20.04
     container:
-      image: grafana/mimir-build-image:update-go-1.17.8-8a996bb57
+      image: grafana/mimir-build-image:chore-build-multiplatform-images-3b8a0c120
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -149,19 +150,23 @@ jobs:
       - name: Build Images
         # Build everything except mimir (run by build-mimir job) and build image (not managed by CI).
         run: |
-          make list-image-targets | grep -v -E '/mimir-build-image/|/cmd/mimir/|/mimir-mixin-tools/' | xargs -I {} make BUILD_IN_CONTAINER=false {}
-      - name: Save Images
-        run: |
-          mkdir /tmp/images
-          ln -s /tmp/images ./docker-images
-          make BUILD_IN_CONTAINER=false save-images
-      - name: Create Docker Images Archive
-        run: tar -cvf tools-images.tar /tmp/images
-      - name: Upload Docker Image Artifact
+          IMAGES="mimirtool metaconvert query-tee"
+          export GIT_REVISION=$(git rev-parse --short HEAD)
+          export VERSION=$(cat "./VERSION" 2> /dev/null)
+          export GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
+          # Configure ko's image creation timestamp to correspond to the commit timestamp
+          export SOURCE_DATE_EPOCH=$(git show -s --format=%ct)
+          export KO_DOCKER_REPO=grafana
+          for name in ${IMAGES}; do
+            ko build -B --image-label org.opencontainers.image.title=${name},org.opencontainers.image.source=https://github.com/grafana/mimir/tree/main/cmd/${name},org.opencontainers.image.revision=${GIT_REVISION} --oci-layout-path ${name}-oci-layout --platform=linux/amd64,linux/arm64 --push=false ./cmd/${name}
+          done
+      - name: Create Tool OCI Image Layouts Archive
+        run: tar -cvf tool-oci-layouts.tar *-oci-layout
+      - name: Upload Tool OCI Image Layouts
         uses: actions/upload-artifact@v2
         with:
-          name: Docker Images Tools
-          path: ./tools-images.tar
+          name: Tool OCI Image Layouts
+          path: ./tool-oci-layouts.tar
 
   integration:
     needs: build-mimir
@@ -182,20 +187,24 @@ jobs:
         uses: actions/checkout@v2
       - name: Install Docker Client
         run: sudo ./.github/workflows/scripts/install-docker.sh
+      # TODO: Work into image, since this job doesn't use the Mimir build image (which has ko installed)
+      # Keep revision in sync with that in Mimir build image
+      - name: Install ko
+        run: |
+          go install github.com/grafana/ko@37f6651b50ba1ecdfb691be4602472d4df8424e4
       - name: Symlink Expected Path to Workspace
         run: |
           sudo mkdir -p /go/src/github.com/grafana/mimir
           sudo ln -s $GITHUB_WORKSPACE/* /go/src/github.com/grafana/mimir
-      - name: Download Docker Images Mimir Artifacts
+      - name: Download Mimir OCI Image Layout
         uses: actions/download-artifact@v2
         with:
-          name: Docker Images Mimir
-      - name: Extract Docker Image Archive
-        run: tar -xvf mimir-images.tar -C /
-      - name: Load Docker Images
+          name: Mimir OCI Image Layout
+      - name: Load Mimir Docker Image
         run: |
-          ln -s /tmp/images ./docker-images
-          make BUILD_IN_CONTAINER=false load-images
+          tar -xvf mimir-oci-layout.tar
+          IMAGE_TAG=$(make image-tag)
+          KO_DOCKER_REPO=grafana ko publish-layout -B --tags ${IMAGE_TAG} --local mimir mimir-oci-layout
       - name: Preload Images
         # We download docker images used by integration tests so that all images are available
         # locally and the download time doesn't account in the test execution time, which is subject
@@ -216,7 +225,7 @@ jobs:
     if: (startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/r') ) && github.event_name == 'push' && github.repository == 'grafana/mimir'
     runs-on: ubuntu-20.04
     container:
-      image: grafana/mimir-build-image:update-go-1.17.8-8a996bb57
+      image: grafana/mimir-build-image:chore-build-multiplatform-images-3b8a0c120
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v2
@@ -226,29 +235,25 @@ jobs:
         run: |
           mkdir -p /go/src/github.com/grafana/mimir
           ln -s $GITHUB_WORKSPACE/* /go/src/github.com/grafana/mimir
-      - name: Download Docker Tool Images Artifacts
+      - name: Download Tool OCI Image Layouts
         uses: actions/download-artifact@v2
         with:
-          name: Docker Images Tools
-      - name: Download Docker Mimir Image Artifacts
+          name: Tool OCI Image Layouts
+      - name: Download Mimir OCI Image Layout
         uses: actions/download-artifact@v2
         with:
-          name: Docker Images Mimir
-      - name: Extract Docker Images
-        run: |
-          tar -xvf mimir-images.tar -C /
-          tar -xvf tools-images.tar -C /
-      - name: Load Images
+          name: Mimir OCI Image Layout
+      - name: Extract OCI Image Layouts
         run: |
-          ln -s /tmp/images ./docker-images
-          make BUILD_IN_CONTAINER=false load-images
+          tar -xvf mimir-oci-layout.tar
+          tar -xvf tool-oci-layouts.tar
       - name: Deploy
         run: |
           if [ -n "$DOCKER_PASSWORD" ]; then
-            printenv DOCKER_PASSWORD | docker login -u "$DOCKER_USERNAME" --password-stdin
+            printenv DOCKER_PASSWORD | ko login -u "$DOCKER_USERNAME" --password-stdin
           fi
-          export IMAGE_TAG=$(make image-tag)
-          ./push-images
+          export IMAGE_TAG=$(./tools/image-tag)
+          make ci-push-images
         env:
           DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
           DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.gitignore b/.gitignore
index c1981871785..19578645a63 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,19 +1,9 @@
 cmd/mimirtool/mimirtool
-cmd/mimirtool/mimirtool_linux_amd64
-cmd/mimirtool/mimirtool_linux_arm64
 cmd/test-exporter/test-exporter
 cmd/mimir/mimir
-cmd/mimir/mimir_linux_amd64
-cmd/mimir/mimir_linux_arm64
 cmd/query-tee/query-tee
-cmd/query-tee/query-tee_linux_amd64
-cmd/query-tee/query-tee_linux_arm64
 cmd/metaconvert/metaconvert
-cmd/metaconvert/metaconvert_linux_amd64
-cmd/metaconvert/metaconvert_linux_arm64
 cmd/mimir-continuous-test/mimir-continuous-test
-cmd/mimir-continuous-test/mimir-continuous-test_linux_amd64
-cmd/mimir-continuous-test/mimir-continuous-test_linux_arm64
 .uptodate
 .pkg
 .cache
diff --git a/.ko.yaml b/.ko.yaml
new file mode 100644
index 00000000000..84b2092180d
--- /dev/null
+++ b/.ko.yaml
@@ -0,0 +1,49 @@
+# ko's standard base image causes our integration tests to fail, due to lack of permission to read
+# TLS CA certificates installed in the filesystem it looks like.
+defaultBaseImage: grafana/alpine:3.15.4
+
+builds:
+  - id: mimir
+    main: ./cmd/mimir
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -X github.com/grafana/mimir/pkg/util/version.Branch={{.Env.GIT_BRANCH}}
+      - -X github.com/grafana/mimir/pkg/util/version.Revision={{.Env.GIT_REVISION}}
+      - -X github.com/grafana/mimir/pkg/util/version.Version={{.Env.VERSION}}
+      - -extldflags "-static"
+      - -s
+      - -w
+  - id: mimirtool
+    main: ./cmd/mimirtool
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -X github.com/grafana/mimir/pkg/util/version.Branch={{.Env.GIT_BRANCH}}
+      - -X github.com/grafana/mimir/pkg/util/version.Revision={{.Env.GIT_REVISION}}
+      - -X github.com/grafana/mimir/pkg/util/version.Version={{.Env.VERSION}}
+      - -extldflags "-static"
+      - -s
+      - -w
+  - id: metaconvert
+    main: ./cmd/metaconvert
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -X github.com/grafana/mimir/pkg/util/version.Branch={{.Env.GIT_BRANCH}}
+      - -X github.com/grafana/mimir/pkg/util/version.Revision={{.Env.GIT_REVISION}}
+      - -X github.com/grafana/mimir/pkg/util/version.Version={{.Env.VERSION}}
+      - -extldflags "-static"
+      - -s
+      - -w
+  - id: query-tee
+    main: ./cmd/query-tee
+    env:
+      - CGO_ENABLED=0
+    ldflags:
+      - -X github.com/grafana/mimir/pkg/util/version.Branch={{.Env.GIT_BRANCH}}
+      - -X github.com/grafana/mimir/pkg/util/version.Revision={{.Env.GIT_REVISION}}
+      - -X github.com/grafana/mimir/pkg/util/version.Version={{.Env.VERSION}}
+      - -extldflags "-static"
+      - -s
+      - -w
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 815e19c62cb..c224ff13876 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,6 +41,7 @@
 * [ENHANCEMENT] Alertmanager: added `insight=true` field to alertmanager dispatch logs. #1379
 * [ENHANCEMENT] Store-gateway: Add the experimental ability to run index header operations in a dedicated thread pool. This feature can be configured using `-blocks-storage.bucket-store.index-header-thread-pool-size` and is disabled by default. #1660
 * [ENHANCEMENT] Querier: wait until inflight queries are completed when shutting down queriers and running Mimir with query-scheduler. #1756
+* [ENHANCEMENT] Docker images are now published as multi-architecture (AMD64/ARM64). #1124
 * [BUGFIX] Query-frontend: do not shard queries with a subquery unless the subquery is inside a shardable aggregation function call. #1542
 * [BUGFIX] Query-frontend: added `component=query-frontend` label to results cache memcached metrics to fix a panic when Mimir is running in single binary mode and results cache is enabled. #1704
 * [BUGFIX] Mimir: services' status content-type is now correctly set to `text/html`. #1575
diff --git a/Makefile b/Makefile
index f9fe5e369db..842efbd195a 100644
--- a/Makefile
+++ b/Makefile
@@ -30,7 +30,9 @@ BINARY_SUFFIX ?= ""
 
 # Boiler plate for building Docker containers.
 # All this must go at top of file I'm afraid.
+# Whenever this variable changes, also update ./push-images
 IMAGE_PREFIX ?= grafana/
+IMAGE_REGISTRY := $(patsubst %/,%,$(IMAGE_PREFIX))
 BUILD_IMAGE ?= $(IMAGE_PREFIX)mimir-build-image
 
 # For a tag push, $GITHUB_REF will look like refs/tags/<tag_name>.
@@ -80,7 +82,7 @@ SED ?= $(shell which gsed 2>/dev/null || which sed)
 # Dependencies (i.e. things that go in the image) still need to be explicitly
 # declared.
 #
-# When building for docker, always build for Linux. This doesn't set GOARCH, which
+# When building for Docker, always build for Linux. This doesn't set GOARCH, which
 # really depends on whether the image is going to be used locally (then GOARCH should be set based on
 # host architecture), or pushed remotely. Ideally one would use push-multiarch-* targets instead
 # in that case.
@@ -96,19 +98,17 @@ SED ?= $(shell which gsed 2>/dev/null || which sed)
 	@echo
 	@touch $@
 
-# This target compiles mimir for linux/amd64 and linux/arm64 and then builds and pushes a multiarch image to the target repository.
-# We don't do separate building of single-platform and multiplatform images here (as we do for push-multiarch-build-image), as
-# these Dockerfiles are not doing much, and are unlikely to fail.
-push-multiarch-%/$(UPTODATE):
-	$(eval DIR := $(patsubst push-multiarch-%/$(UPTODATE),%,$@))
+# This target builds a multi-arch (linux/amd64, linux/arm64) Mimir Docker image manifest list, and pushes it to the target repository.
+push-multiarch-mimir:
+	@echo "Pushing $(IMAGE_REGISTRY)/mimir:$(IMAGE_TAG)"
 
-	if [ -f $(DIR)/main.go ]; then \
-		$(MAKE) GOOS=linux GOARCH=amd64 BINARY_SUFFIX=_linux_amd64 $(DIR)/$(shell basename $(DIR)); \
-		$(MAKE) GOOS=linux GOARCH=arm64 BINARY_SUFFIX=_linux_arm64 $(DIR)/$(shell basename $(DIR)); \
-	fi
-	$(SUDO) docker buildx build -o type=registry --platform linux/amd64,linux/arm64 --build-arg=revision=$(GIT_REVISION) --build-arg=goproxyValue=$(GOPROXY_VALUE) --build-arg=USE_BINARY_SUFFIX=true -t $(IMAGE_PREFIX)$(shell basename $(DIR)):$(IMAGE_TAG) $(DIR)/
+	KO_DOCKER_REPO=$(IMAGE_REGISTRY) GIT_BRANCH=$(GIT_BRANCH) GIT_REVISION=$(GIT_REVISION) VERSION=$(VERSION) \
+	ko build -B --image-label org.opencontainers.image.title=mimir,\
+	org.opencontainers.image.source=https://github.com/grafana/mimir/tree/main/cmd/mimir,\
+	org.opencontainers.image.revision=$(GIT_REVISION) \
+	--platform=linux/amd64,linux/arm64 --tags $(IMAGE_TAG) ./cmd/mimir
 
-push-multiarch-mimir: push-multiarch-cmd/mimir/.uptodate
+IMAGE_NAMES := mimir mimirtool metaconvert query-tee
 
 # This target fetches current build image, and tags it with "latest" tag. It can be used instead of building the image locally.
 .PHONY: fetch-build-image
@@ -139,11 +139,12 @@ MAKE_FILES = $(shell find . $(DONT_FIND) \( -name 'Makefile' -o -name '*.mk' \)
 
 # Get a list of directories containing Dockerfiles
 DOCKERFILES := $(shell find . $(DONT_FIND) -type f -name 'Dockerfile' -print)
-UPTODATE_FILES := $(patsubst %/Dockerfile,%/$(UPTODATE),$(DOCKERFILES))
+DOCKER_UPTODATE_FILES := $(patsubst %/Dockerfile,%/$(UPTODATE),$(DOCKERFILES))
 DOCKER_IMAGE_DIRS := $(patsubst %/Dockerfile,%,$(DOCKERFILES))
-IMAGE_NAMES := $(foreach dir,$(DOCKER_IMAGE_DIRS),$(patsubst %,$(IMAGE_PREFIX)%,$(shell basename $(dir))))
+# Names of images built with Docker
+DOCKER_IMAGE_NAMES := $(foreach dir,$(DOCKER_IMAGE_DIRS),$(patsubst %,$(IMAGE_PREFIX)%,$(shell basename $(dir))))
 images:
-	$(info $(IMAGE_NAMES))
+	$(info $(DOCKER_IMAGE_NAMES))
 	@echo > /dev/null
 
 # Generating proto code is automated.
@@ -154,6 +155,7 @@ PROTO_GOS := $(patsubst %.proto,%.pb.go,$(PROTO_DEFS))
 # for every directory with main.go in it.
 MAIN_GO := $(shell find . $(DONT_FIND) -type f -name 'main.go' -print)
 EXES := $(foreach exeDir,$(patsubst %/main.go, %, $(MAIN_GO)),$(exeDir)/$(notdir $(exeDir)))
+CMD_MAIN_GO := $(shell find ./cmd $(DONT_FIND) -type f -name 'main.go' -print)
 GO_FILES := $(shell find . $(DONT_FIND) -name cmd -prune -o -name '*.pb.go' -prune -o -type f -name '*.go' -print)
 define dep_exe
 $(1): $(dir $(1))/main.go $(GO_FILES) protos
@@ -179,7 +181,7 @@ pkg/storegateway/storegatewaypb/gateway.pb.go: pkg/storegateway/storegatewaypb/g
 pkg/alertmanager/alertmanagerpb/alertmanager.pb.go: pkg/alertmanager/alertmanagerpb/alertmanager.proto
 pkg/alertmanager/alertspb/alerts.pb.go: pkg/alertmanager/alertspb/alerts.proto
 
-all: $(UPTODATE_FILES)
+all: exes $(DOCKER_UPTODATE_FILES) load-docker-images
 test: protos
 test-with-race: protos
 mod-check: protos
@@ -189,7 +191,7 @@ mimir-build-image/$(UPTODATE): mimir-build-image/*
 # All the boiler plate for building golang follows:
 SUDO := $(shell docker info >/dev/null 2>&1 || echo "sudo -E")
 BUILD_IN_CONTAINER ?= true
-LATEST_BUILD_IMAGE_TAG ?= update-go-1.17.8-8a996bb57
+LATEST_BUILD_IMAGE_TAG ?= chore-build-multiplatform-images-3b8a0c120
 
 # TTY is parameterized to allow Google Cloud Builder to run builds,
 # as it currently disallows TTY devices. This value needs to be overridden
@@ -399,11 +401,8 @@ format-makefiles: $(MAKE_FILES)
 	$(SED) -i -e 's/^\(\t*\)  /\1\t/g' -e 's/^\(\t*\) /\1/' -- $?
 
 clean:
-	$(SUDO) docker rmi $(IMAGE_NAMES) >/dev/null 2>&1 || true
-	rm -rf -- $(UPTODATE_FILES) $(EXES) .cache dist
-	# Remove executables built for multiarch images.
-	find . -type f -name '*_linux_arm64' -perm +u+x -exec rm {} \;
-	find . -type f -name '*_linux_amd64' -perm +u+x -exec rm {} \;
+	$(SUDO) docker rmi $(DOCKER_IMAGE_NAMES) >/dev/null 2>&1 || true
+	rm -rf -- $(DOCKER_UPTODATE_FILES) $(EXES) .cache dist
 	go clean ./...
 
 clean-protos:
@@ -411,35 +410,23 @@ clean-protos:
 
 # List all images building make targets.
 list-image-targets:
-	@echo $(UPTODATE_FILES) | tr " " "\n"
-
-save-images:
-	@mkdir -p docker-images
-	for image_name in $(IMAGE_NAMES); do \
-		if echo $$image_name | grep -q build; then \
-			continue; \
-		fi; \
-		if [ "$$(docker images -q $$image_name:$(IMAGE_TAG) 2> /dev/null)" = "" ]; then \
-			echo "Skipping $$image_name:$(IMAGE_TAG) because image does not exist"; \
-		else \
-			echo "Saving $$image_name:$(IMAGE_TAG)"; \
-			docker save $$image_name:$(IMAGE_TAG) -o docker-images/$$(echo $$image_name | tr "/" _):$(IMAGE_TAG); \
-		fi; \
-	done
-
-load-images:
-	for image_name in $(IMAGE_NAMES); do \
-		if echo $$image_name | grep -q build; then \
-			continue; \
-		fi; \
-		image_path=docker-images/$$(echo $$image_name | tr "/" _):$(IMAGE_TAG); \
-		if [ -e "$$image_path" ]; then \
-			echo "Loading $$image_path"; \
-			docker load -i "$$image_path"; \
-		else \
-			echo "Skipping $$image_path because image does not exist"; \
-		fi; \
-	done
+	@echo $(DOCKER_UPTODATE_FILES) | tr " " "\n"
+
+LOAD_IMAGE_TARGETS := $(foreach exe, $(patsubst ./cmd/%/main.go,%,$(CMD_MAIN_GO)), load-$(exe)-image)
+
+.PHONY: $(LOAD_IMAGE_TARGETS)
+$(LOAD_IMAGE_TARGETS): CMD_NAME=$(patsubst load-%-image,%,$@)
+$(LOAD_IMAGE_TARGETS):
+	@echo Loading $(CMD_NAME) image
+	export KO_DOCKER_REPO=$(IMAGE_REGISTRY); \
+	export SOURCE_DATE_EPOCH=$$(git show -s --format=%ct); \
+	export VERSION=$(VERSION); \
+	export GIT_BRANCH=$(GIT_BRANCH); \
+	export GIT_REVISION=$(GIT_REVISION); \
+	ko build -B --image-label org.opencontainers.image.title=$(CMD_NAME),org.opencontainers.image.source=https://github.com/grafana/mimir/tree/main/cmd/$(CMD_NAME),org.opencontainers.image.revision=$(GIT_REVISION) --tags $(IMAGE_TAG),latest --push=false --local ./cmd/$(CMD_NAME)
+
+.PHONY: load-docker-images
+load-docker-images: $(LOAD_IMAGE_TARGETS)
 
 clean-doc:
 	rm -f $(DOC_TEMPLATES:.template=.md)
@@ -516,9 +503,13 @@ check-jsonnet-tests: build-jsonnet-tests
 check-tsdb-blocks-storage-s3-docker-compose-yaml:
 	cd development/tsdb-blocks-storage-s3 && make check
 
-integration-tests: cmd/mimir/$(UPTODATE)
+integration-tests: load-mimir-image
 	go test -tags=requires_docker ./integration/...
 
 include docs/docs.mk
 DOCS_DIR = docs/sources
 docs: doc
+
+.PHONY: ci-push-images
+ci-push-images:
+	IMAGE_TAG="$(IMAGE_TAG)" IMAGES="$(IMAGE_NAMES)" ./push-images
diff --git a/cmd/metaconvert/Dockerfile b/cmd/metaconvert/Dockerfile
deleted file mode 100644
index 4acc3391f57..00000000000
--- a/cmd/metaconvert/Dockerfile
+++ /dev/null
@@ -1,20 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Provenance-includes-location: https://github.com/cortexproject/cortex/cmd/thanosconvert/Dockerfile
-# Provenance-includes-license: Apache-2.0
-# Provenance-includes-copyright: The Cortex Authors.
-
-FROM       alpine:3.15.0
-RUN        apk add --no-cache ca-certificates
-# Expose TARGETOS and TARGETARCH variables. These are supported by Docker when using BuildKit, but must be "enabled" using ARG.
-ARG        TARGETOS
-ARG        TARGETARCH
-ARG        BINARY_SUFFIX="_${TARGETOS}_${TARGETARCH}"
-# Set to non-empty value to use ${TARGET_SUFFIX} when copying binary, leave unset to use no suffix.
-ARG        USE_BINARY_SUFFIX
-COPY       metaconvert${USE_BINARY_SUFFIX:+${BINARY_SUFFIX}} /metaconvert
-ENTRYPOINT ["/metaconvert"]
-
-ARG revision
-LABEL org.opencontainers.image.title="metaconvert" \
-      org.opencontainers.image.source="https://github.com/grafana/mimir/tree/main/cmd/metaconvert" \
-      org.opencontainers.image.revision="${revision}"
diff --git a/cmd/mimir/Dockerfile b/cmd/mimir/Dockerfile
deleted file mode 100644
index d813a84617d..00000000000
--- a/cmd/mimir/Dockerfile
+++ /dev/null
@@ -1,21 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Provenance-includes-location: https://github.com/cortexproject/cortex/cmd/cortex/Dockerfile
-# Provenance-includes-license: Apache-2.0
-# Provenance-includes-copyright: The Cortex Authors.
-
-FROM       alpine:3.15.0
-RUN        apk add --no-cache ca-certificates
-# Expose TARGETOS and TARGETARCH variables. These are supported by Docker when using BuildKit, but must be "enabled" using ARG.
-ARG        TARGETOS
-ARG        TARGETARCH
-ARG        BINARY_SUFFIX="_${TARGETOS}_${TARGETARCH}"
-# Set to non-empty value to use ${TARGET_SUFFIX} when copying mimir binary, leave unset to use no suffix.
-ARG        USE_BINARY_SUFFIX
-COPY       mimir${USE_BINARY_SUFFIX:+${BINARY_SUFFIX}} /bin/mimir
-EXPOSE     8080
-ENTRYPOINT [ "/bin/mimir" ]
-
-ARG revision
-LABEL org.opencontainers.image.title="mimir" \
-      org.opencontainers.image.source="https://github.com/grafana/mimir/tree/main/cmd/mimir" \
-      org.opencontainers.image.revision="${revision}"
diff --git a/cmd/mimirtool/Dockerfile b/cmd/mimirtool/Dockerfile
deleted file mode 100644
index 55a6257353a..00000000000
--- a/cmd/mimirtool/Dockerfile
+++ /dev/null
@@ -1,12 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-
-FROM       alpine:3.15.0
-RUN        apk add --no-cache ca-certificates
-# Expose TARGETOS and TARGETARCH variables. These are supported by Docker when using BuildKit, but must be "enabled" using ARG.
-ARG        TARGETOS
-ARG        TARGETARCH
-ARG        BINARY_SUFFIX="_${TARGETOS}_${TARGETARCH}"
-# Set to non-empty value to use ${TARGET_SUFFIX} when copying binary, leave unset to use no suffix.
-ARG        USE_BINARY_SUFFIX
-COPY       mimirtool${USE_BINARY_SUFFIX:+${BINARY_SUFFIX}} /bin/mimirtool
-ENTRYPOINT [ "/bin/mimirtool" ]
diff --git a/cmd/query-tee/Dockerfile b/cmd/query-tee/Dockerfile
deleted file mode 100644
index 8b039303f88..00000000000
--- a/cmd/query-tee/Dockerfile
+++ /dev/null
@@ -1,20 +0,0 @@
-# SPDX-License-Identifier: AGPL-3.0-only
-# Provenance-includes-location: https://github.com/cortexproject/cortex/cmd/query-tee/Dockerfile
-# Provenance-includes-license: Apache-2.0
-# Provenance-includes-copyright: The Cortex Authors.
-
-FROM       alpine:3.15.0
-RUN        apk add --no-cache ca-certificates
-# Expose TARGETOS and TARGETARCH variables. These are supported by Docker when using BuildKit, but must be "enabled" using ARG.
-ARG        TARGETOS
-ARG        TARGETARCH
-ARG        BINARY_SUFFIX="_${TARGETOS}_${TARGETARCH}"
-# Set to non-empty value to use ${TARGET_SUFFIX} when copying binary, leave unset to use no suffix.
-ARG        USE_BINARY_SUFFIX
-COPY       query-tee${USE_BINARY_SUFFIX:+${BINARY_SUFFIX}} /query-tee
-ENTRYPOINT ["/query-tee"]
-
-ARG revision
-LABEL org.opencontainers.image.title="query-tee" \
-      org.opencontainers.image.source="https://github.com/grafana/mimir/tree/main/cmd/query-tee" \
-      org.opencontainers.image.revision="${revision}"
diff --git a/mimir-build-image/Dockerfile b/mimir-build-image/Dockerfile
index 88aec268cc3..3f19766cce8 100644
--- a/mimir-build-image/Dockerfile
+++ b/mimir-build-image/Dockerfile
@@ -45,6 +45,7 @@ RUN GO111MODULE=on \
 	go install github.com/monitoring-mixins/mixtool/cmd/mixtool@bca3066 && \
 	go install github.com/mikefarah/yq/v4@v4.13.4 && \
 	go install github.com/google/go-jsonnet/cmd/jsonnetfmt@v0.17.0 && \
+	go install github.com/grafana/ko@37f6651b50ba1ecdfb691be4602472d4df8424e4 && \
 	rm -rf /go/pkg /go/src /root/.cache
 
 ENV NODE_PATH=/usr/lib/node_modules
diff --git a/push-images b/push-images
index 68757d0e7c6..e227eb38e85 100755
--- a/push-images
+++ b/push-images
@@ -1,10 +1,10 @@
 #!/usr/bin/env bash
-
 set -o errexit
 set -o nounset
 set -o pipefail
 
 IMAGE_TAG=${IMAGE_TAG:-$(./tools/image-tag)}
+KO_DOCKER_REPO=grafana
 
 usage() {
     echo "$0"
@@ -20,28 +20,23 @@ while [ $# -gt 0 ]; do
     esac
 done
 
-push_image() {
-    local image="$1"
-    echo "Pushing ${image}:${IMAGE_TAG}"
-    docker push "${image}:${IMAGE_TAG}"
+if [[ -z "${IMAGES}" ]]; then
+    echo '$IMAGES must be set'
+    exit 2
+fi
+
+# Push images
+for image in ${IMAGES}; do
+    IMAGE_TAGS=${IMAGE_TAG}
+    echo "Pushing ${KO_DOCKER_REPO}/${image}:${IMAGE_TAG}"
 
     # If image is the latest stable git tag, update the latest docker image tag.
     # Do not tag with latest any release candidate (tag ends with "-rc.*").
     if [[ "$(git tag | grep -E '^mimir-[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1)" == "mimir-${IMAGE_TAG}" ]]; then
-      docker tag "${image}:${IMAGE_TAG}" "${image}:latest"
-      docker push "${image}:latest"
+        echo "Pushing also ${KO_DOCKER_REPO}/${image}:latest"
+        IMAGE_TAGS="${IMAGE_TAG},latest"
     fi
-}
-
-# Push images
-for image in $(make images); do
-    image_name=$(basename "$image")
-    case "$image_name" in
-        mimir-build-image)
-            # skip mimir-build-image
-            continue
-            ;;
-    esac
 
-    push_image "${image}"
+    export KO_DOCKER_REPO
+    ko publish-layout -B --tags ${IMAGE_TAGS} ${image} ${image}-oci-layout
 done