diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4b196e83..283a6432 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,7 +41,7 @@ jobs:
         name: generate tags
         id: meta
         with:
-          images: ghcr.io/SiaFoundation/hostd
+          images: ghcr.io/${{ github.repository }}
           tags: |
             type=ref,event=branch
             type=sha,prefix=
@@ -53,6 +53,8 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
   build-linux:
     runs-on: ubuntu-latest
     needs: [ test ]
@@ -189,6 +191,7 @@ jobs:
       - name: Setup
         shell: bash
         run: |
+          dotnet tool install --global AzureSignTool
           go generate ./...
       - name: Build amd64
         env:
@@ -200,6 +203,7 @@ jobs:
           mkdir -p release
           ZIP_OUTPUT=release/hostd_${GOOS}_${GOARCH}.zip
           go build -tags='netgo' -trimpath -o bin/ -a -ldflags '-s -w -linkmode external -extldflags "-static"' ./cmd/hostd
+          azuresigntool sign -kvu "${{ secrets.AZURE_KEY_VAULT_URI }}" -kvi "${{ secrets.AZURE_CLIENT_ID }}" -kvt "${{ secrets.AZURE_TENANT_ID }}" -kvs "${{ secrets.AZURE_CLIENT_SECRET }}" -kvc ${{ secrets.AZURE_CERT_NAME }} -tr http://timestamp.digicert.com -v bin/hostd.exe
           cp README.md LICENSE bin/
           7z a $ZIP_OUTPUT ./bin/*
       - uses: actions/upload-artifact@v3
diff --git a/.github/workflows/publish_testnet.yml b/.github/workflows/publish_testnet.yml
index 3a8bc05a..9480e44f 100644
--- a/.github/workflows/publish_testnet.yml
+++ b/.github/workflows/publish_testnet.yml
@@ -41,7 +41,7 @@ jobs:
         name: generate tags
         id: meta
         with:
-          images: ghcr.io/SiaFoundation/hostd
+          images: ghcr.io/${{ github.repository }}
           flavor: |
             suffix=-testnet,onlatest=true
           tags: |
@@ -55,6 +55,8 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
   build-linux:
     runs-on: ubuntu-latest
     needs: [ test ]
@@ -191,6 +193,7 @@ jobs:
       - name: Setup
         shell: bash
         run: |
+          dotnet tool install --global AzureSignTool
           go generate ./...
       - name: Build amd64
         env:
@@ -202,6 +205,7 @@ jobs:
           mkdir -p release
           ZIP_OUTPUT=release/hostd_zen_${GOOS}_${GOARCH}.zip
           go build -tags='testnet netgo' -trimpath -o bin/ -a -ldflags '-s -w -linkmode external -extldflags "-static"' ./cmd/hostd
+          azuresigntool sign -kvu "${{ secrets.AZURE_KEY_VAULT_URI }}" -kvi "${{ secrets.AZURE_CLIENT_ID }}" -kvt "${{ secrets.AZURE_TENANT_ID }}" -kvs "${{ secrets.AZURE_CLIENT_SECRET }}" -kvc ${{ secrets.AZURE_CERT_NAME }} -tr http://timestamp.digicert.com -v bin/hostd.exe
           cp README.md LICENSE bin/
           7z a $ZIP_OUTPUT ./bin/*
       - uses: actions/upload-artifact@v3