diff --git a/bin/build.sh b/bin/build.sh
index 38da7c78..7eecf3ad 100755
--- a/bin/build.sh
+++ b/bin/build.sh
@@ -20,7 +20,7 @@ RUN_IMAGE_TAG="heroku/heroku:${STACK_VERSION}"
 RUN_DOCKERFILE_DIR="heroku-${STACK_VERSION}"
 [[ -d "${RUN_DOCKERFILE_DIR}" ]] || abort "fatal: directory ${RUN_DOCKERFILE_DIR} not found"
 display "Building ${RUN_DOCKERFILE_DIR} / ${RUN_IMAGE_TAG} Heroku runtime image"
-docker buildx build --pull --platform=linux/arm64,linux/amd64 --tag "${RUN_IMAGE_TAG}" "${RUN_DOCKERFILE_DIR}" | indent
+docker buildx build --pull --platform=linux/arm64,linux/amd64 --tag "${RUN_IMAGE_TAG}" --push "${RUN_DOCKERFILE_DIR}" | indent
 write_package_list "${RUN_IMAGE_TAG}" "${RUN_DOCKERFILE_DIR}"
 
 # The --pull option is not used for variants to ensure they are based on the
@@ -29,7 +29,7 @@ write_package_list "${RUN_IMAGE_TAG}" "${RUN_DOCKERFILE_DIR}"
 BUILD_IMAGE_TAG="${RUN_IMAGE_TAG}-build"
 BUILD_DOCKERFILE_DIR="${RUN_DOCKERFILE_DIR}-build"
 display "Building ${BUILD_DOCKERFILE_DIR} / ${BUILD_IMAGE_TAG} Heroku build-time image"
-docker buildx build --platform=linux/arm64,linux/amd64 --tag "$BUILD_IMAGE_TAG" "$BUILD_DOCKERFILE_DIR" | indent
+docker buildx build --platform=linux/arm64,linux/amd64 --tag "$BUILD_IMAGE_TAG" --push "$BUILD_DOCKERFILE_DIR" | indent
 write_package_list "$BUILD_IMAGE_TAG" "$BUILD_DOCKERFILE_DIR"
 
 # write_package_list is not needed for *cnb* variants, as they don't install
@@ -38,12 +38,12 @@ write_package_list "$BUILD_IMAGE_TAG" "$BUILD_DOCKERFILE_DIR"
 CNB_RUN_IMAGE_TAG="${RUN_IMAGE_TAG}-cnb"
 CNB_RUN_DOCKERFILE_DIR="${RUN_DOCKERFILE_DIR}-cnb"
 display "Building ${CNB_RUN_DOCKERFILE_DIR} / ${CNB_RUN_IMAGE_TAG} CNB runtime image"
-docker buildx build --platform=linux/arm64,linux/amd64 --tag "$CNB_RUN_IMAGE_TAG" "$CNB_RUN_DOCKERFILE_DIR" | indent
+docker buildx build --platform=linux/arm64,linux/amd64 --tag "$CNB_RUN_IMAGE_TAG" --push "$CNB_RUN_DOCKERFILE_DIR" | indent
 
 CNB_BUILD_IMAGE_TAG="${RUN_IMAGE_TAG}-cnb-build"
 CNB_BUILD_DOCKERFILE_DIR="${RUN_DOCKERFILE_DIR}-cnb-build"
 display "Building ${CNB_BUILD_DOCKERFILE_DIR} / ${CNB_BUILD_IMAGE_TAG} CNB build-time image"
-docker buildx build --platform=linux/arm64,linux/amd64 --tag "$CNB_BUILD_IMAGE_TAG" "$CNB_BUILD_DOCKERFILE_DIR" | indent
+docker buildx build --platform=linux/arm64,linux/amd64 --tag "$CNB_BUILD_IMAGE_TAG" --push "$CNB_BUILD_DOCKERFILE_DIR" | indent
 
 display "Size breakdown..."
 docker images --format "table {{.Repository}}:{{.Tag}}\t{{.Size}}" \
diff --git a/bin/publish-to-registries.sh b/bin/publish-to-registries.sh
index 1911003e..e32d34fa 100755
--- a/bin/publish-to-registries.sh
+++ b/bin/publish-to-registries.sh
@@ -3,13 +3,12 @@
 set -euo pipefail
 set -x
 
-
-bin/build.sh "${STACK_VERSION}"
-
 # Disable tracing temporarily to prevent logging registry tokens.
 (set +x; echo "${DOCKER_HUB_TOKEN}" | docker login -u "${DOCKER_HUB_USERNAME}" --password-stdin)
 (set +x; curl -f -X POST "$ID_SERVICE_TOKEN_ENDPOINT" -d "{\"username\":\"$ID_SERVICE_USERNAME\",\"password\":\"$ID_SERVICE_PASSWORD\"}" -s --retry 3 | jq -r ".raw_id_token" | docker login "$INTERNAL_REGISTRY_HOST" -u "$INTERNAL_REGISTRY_USERNAME" --password-stdin)
 
+bin/build.sh "${STACK_VERSION}"
+
 push_group() {
     local targetTagBase="$1"
     local targetTagSuffix="$2"
@@ -38,10 +37,4 @@ if [[ -v CIRCLE_TAG ]]; then
 
   # Push release tags to internal registry
   push_group "${internalTag}" ".${CIRCLE_TAG}"
-
-  # Push latest/no-suffix tags to dockerhub (e.g. heroku/heroku:22)
-  push_group "${publicTag}" ""
-
-  # Push latest/no-suffix tags to internal registry
-  push_group "${internalTag}" ""
 fi