diff --git a/common.mk b/common.mk
index a061ae16d..fefafffb7 100644
--- a/common.mk
+++ b/common.mk
@@ -22,6 +22,8 @@ else
 GOBIN=$(shell go env GOBIN)
 endif
 
+image-tag = $(shell echo "$1" | sed 's/+/-/')
+
 .PHONY: print-%
 print-%:
 	@echo -n $($*)
@@ -90,13 +92,12 @@ apko-print-pkg-version: apko-template check-env-PACKAGE_NAME
 		head -n1
 
 .PHONY: apko-output-image
-apko-output-image:
+apko-output-image: check-env-IMAGE
 	@digest=$$(cut -s -d'@' -f2 build/digest); \
 	if [ -z "$$digest" ]; then \
 		echo "error: no image digest found" >&2; \
 		exit 1; \
 	fi ; \
-	mkdir -p build; \
 	echo "$(IMAGE)@$$digest" > build/image
 
 .PHONY: melange-build
diff --git a/dagger/chainguard.go b/dagger/chainguard.go
new file mode 100644
index 000000000..6f2b24bc0
--- /dev/null
+++ b/dagger/chainguard.go
@@ -0,0 +1,111 @@
+package main
+
+import (
+	"fmt"
+
+	"dagger/embedded-cluster/internal/dagger"
+)
+
+type chainguard struct{}
+
+func (m *chainguard) melangeBuildGo(
+	src *dagger.Directory,
+	melangeFile *dagger.File,
+	// +default="amd64,arm64"
+	arch string,
+	// +default="latest"
+	imageTag string,
+) *dagger.Container {
+
+	keygen := m.melangeKeygen(imageTag)
+
+	c := dag.Container().
+		From(fmt.Sprintf("cgr.dev/chainguard/melange:%s", imageTag)).
+		WithDirectory("/workspace", src).
+		WithFile("/workspace/melange.yaml", melangeFile).
+		WithFile("/workspace/melange.rsa", keygen.File("/workspace/melange.rsa")).
+		WithMountedCache("/go/pkg/mod", dag.CacheVolume("go-mod")).
+		WithWorkdir("/workspace").
+		WithExec(
+			[]string{
+				"melange", "build", "melange.yaml",
+				"--signing-key", "melange.rsa",
+				"--cache-dir", "/go/pkg/mod",
+				"--arch", arch,
+				"--out-dir", "build/packages/",
+			},
+			dagger.ContainerWithExecOpts{
+				ExperimentalPrivilegedNesting: true,
+				InsecureRootCapabilities:      true,
+			},
+		)
+
+	// for output
+	c = c.WithFile("/workspace/build/melange.rsa.pub", keygen.File("/workspace/melange.rsa.pub"))
+
+	return c
+}
+
+func (m *chainguard) melangeKeygen(
+	// +default="latest"
+	imageTag string,
+) *dagger.Container {
+	keygen := dag.Container().
+		From(fmt.Sprintf("cgr.dev/chainguard/melange:%s", imageTag)).
+		WithWorkdir("/workspace").
+		WithExec([]string{"melange", "keygen"})
+
+	return keygen
+}
+
+func (m *chainguard) apkoBuild(
+	src *dagger.Directory,
+	apkoFile *dagger.File,
+	image string,
+	// +default="amd64,arm64"
+	arch string,
+	// +default="latest"
+	imageTag string,
+) *dagger.Container {
+
+	c := dag.Container().
+		From(fmt.Sprintf("cgr.dev/chainguard/apko:%s", imageTag)).
+		WithDirectory("/workspace", src).
+		WithFile("/workspace/apko.yaml", apkoFile).
+		WithWorkdir("/workspace").
+		WithExec(
+			[]string{
+				"apko", "build", "apko.yaml", image, "apko.tar",
+				"--cache-dir", "/go/pkg/mod",
+				"--arch", arch,
+			},
+		)
+
+	return c
+}
+
+func (m *chainguard) apkoPublish(
+	src *dagger.Directory,
+	apkoFile *dagger.File,
+	image string,
+	// +default="amd64,arm64"
+	arch string,
+	// +default="latest"
+	imageTag string,
+) *dagger.Container {
+
+	c := dag.Container().
+		From(fmt.Sprintf("cgr.dev/chainguard/apko:%s", imageTag)).
+		WithDirectory("/workspace", src).
+		WithFile("/workspace/apko.yaml", apkoFile).
+		WithWorkdir("/workspace").
+		WithExec(
+			[]string{
+				"apko", "publish", "apko.yaml", image,
+				"--cache-dir", "/go/pkg/mod",
+				"--arch", arch,
+			},
+		)
+
+	return c
+}
diff --git a/dagger/go.mod b/dagger/go.mod
index f69bc757f..9469b58b2 100644
--- a/dagger/go.mod
+++ b/dagger/go.mod
@@ -6,31 +6,33 @@ require (
 	github.com/99designs/gqlgen v0.17.49
 	github.com/Khan/genqlient v0.7.0
 	github.com/vektah/gqlparser/v2 v2.5.16
-	go.opentelemetry.io/otel v1.27.0
+	go.opentelemetry.io/otel v1.30.0
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.0.0-20240518090000-14441aefdf88
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.3.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0
 	go.opentelemetry.io/otel/log v0.3.0
-	go.opentelemetry.io/otel/sdk v1.27.0
+	go.opentelemetry.io/otel/sdk v1.30.0
 	go.opentelemetry.io/otel/sdk/log v0.3.0
-	go.opentelemetry.io/otel/trace v1.27.0
+	go.opentelemetry.io/otel/trace v1.30.0
 	go.opentelemetry.io/proto/otlp v1.3.1
-	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
 	golang.org/x/sync v0.8.0
 	google.golang.org/grpc v1.66.1
 )
 
 require (
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/sosodev/duration v1.3.1 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0 // indirect
-	go.opentelemetry.io/otel/metric v1.27.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
+	go.opentelemetry.io/otel/metric v1.30.0 // indirect
 	golang.org/x/net v0.29.0 // indirect
 	golang.org/x/sys v0.25.0 // indirect
 	golang.org/x/text v0.18.0 // indirect
diff --git a/dagger/go.sum b/dagger/go.sum
index 40f88b0b1..0f170f1ea 100644
--- a/dagger/go.sum
+++ b/dagger/go.sum
@@ -7,8 +7,9 @@ github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
 github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -23,8 +24,9 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0/go.mod h1:ggCgvZ2r7uOoQjOyu2Y1
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/sosodev/duration v1.3.1 h1:qtHBDMQ6lvMQsL15g4aopM4HEfOaYuhWBw3NPTtlqq4=
@@ -35,34 +37,34 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/vektah/gqlparser/v2 v2.5.16 h1:1gcmLTvs3JLKXckwCwlUagVn/IlV2bwqle0vJ0vy5p8=
 github.com/vektah/gqlparser/v2 v2.5.16/go.mod h1:1lz1OeCqgQbQepsGxPVywrjdBHW2T08PUS3pJqepRww=
-go.opentelemetry.io/otel v1.27.0 h1:9BZoF3yMK/O1AafMiQTVu0YDj5Ea4hPhxCs7sGva+cg=
-go.opentelemetry.io/otel v1.27.0/go.mod h1:DMpAK8fzYRzs+bi3rS5REupisuqTheUlSZJ1WnZaPAQ=
+go.opentelemetry.io/otel v1.30.0 h1:F2t8sK4qf1fAmY9ua4ohFS/K+FUuOPemHUIXHtktrts=
+go.opentelemetry.io/otel v1.30.0/go.mod h1:tFw4Br9b7fOS+uEao81PJjVMjW/5fvNCbpsDIXqP0pc=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.0.0-20240518090000-14441aefdf88 h1:oM0GTNKGlc5qHctWeIGTVyda4iFFalOzMZ3Ehj5rwB4=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.0.0-20240518090000-14441aefdf88/go.mod h1:JGG8ebaMO5nXOPnvKEl+DiA4MGwFjCbjsxT1WHIEBPY=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.3.0 h1:ccBrA8nCY5mM0y5uO7FT0ze4S0TuFcWdDB2FxGMTjkI=
 go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.3.0/go.mod h1:/9pb6634zi2Lk8LYg9Q0X8Ar6jka4dkFOylBLbVQPCE=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0 h1:R9DE4kQ4k+YtfLI2ULwX82VtNQ2J8yZmA7ZIF/D+7Mc=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.27.0/go.mod h1:OQFyQVrDlbe+R7xrEyDr/2Wr67Ol0hRUgsfA+V5A95s=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 h1:3Q/xZUyC1BBkualc9ROb4G8qkH90LXEIICcs5zv1OYY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0/go.mod h1:s75jGIWA9OfCMzF0xr+ZgfrB5FEbbV7UuYo32ahUiFI=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0 h1:qFffATk0X+HD+f1Z8lswGiOQYKHRlzfmdJm0wEaVrFA=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.27.0/go.mod h1:MOiCmryaYtc+V0Ei+Tx9o5S1ZjA7kzLucuVuyzBZloQ=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0 h1:QY7/0NeRPKlzusf40ZE4t1VlMKbqSNT7cJRYzWuja0s=
 go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.27.0/go.mod h1:HVkSiDhTM9BoUJU8qE6j2eSWLLXvi1USXjyd2BXT8PY=
 go.opentelemetry.io/otel/log v0.3.0 h1:kJRFkpUFYtny37NQzL386WbznUByZx186DpEMKhEGZs=
 go.opentelemetry.io/otel/log v0.3.0/go.mod h1:ziCwqZr9soYDwGNbIL+6kAvQC+ANvjgG367HVcyR/ys=
-go.opentelemetry.io/otel/metric v1.27.0 h1:hvj3vdEKyeCi4YaYfNjv2NUje8FqKqUY8IlF0FxV/ik=
-go.opentelemetry.io/otel/metric v1.27.0/go.mod h1:mVFgmRlhljgBiuk/MP/oKylr4hs85GZAylncepAX/ak=
-go.opentelemetry.io/otel/sdk v1.27.0 h1:mlk+/Y1gLPLn84U4tI8d3GNJmGT/eXe3ZuOXN9kTWmI=
-go.opentelemetry.io/otel/sdk v1.27.0/go.mod h1:Ha9vbLwJE6W86YstIywK2xFfPjbWlCuwPtMkKdz/Y4A=
+go.opentelemetry.io/otel/metric v1.30.0 h1:4xNulvn9gjzo4hjg+wzIKG7iNFEaBMX00Qd4QIZs7+w=
+go.opentelemetry.io/otel/metric v1.30.0/go.mod h1:aXTfST94tswhWEb+5QjlSqG+cZlmyXy/u8jFpor3WqQ=
+go.opentelemetry.io/otel/sdk v1.30.0 h1:cHdik6irO49R5IysVhdn8oaiR9m8XluDaJAs4DfOrYE=
+go.opentelemetry.io/otel/sdk v1.30.0/go.mod h1:p14X4Ok8S+sygzblytT1nqG98QG2KYKv++HE0LY/mhg=
 go.opentelemetry.io/otel/sdk/log v0.3.0 h1:GEjJ8iftz2l+XO1GF2856r7yYVh74URiF9JMcAacr5U=
 go.opentelemetry.io/otel/sdk/log v0.3.0/go.mod h1:BwCxtmux6ACLuys1wlbc0+vGBd+xytjmjajwqqIul2g=
-go.opentelemetry.io/otel/trace v1.27.0 h1:IqYb813p7cmbHk0a5y6pD5JPakbVfftRXABGt5/Rscw=
-go.opentelemetry.io/otel/trace v1.27.0/go.mod h1:6RiD1hkAprV4/q+yd2ln1HG9GoPx39SuvvstaLBl+l4=
+go.opentelemetry.io/otel/trace v1.30.0 h1:7UBkkYzeg3C7kQX8VAidWh2biiQbtAKjyIML8dQ9wmc=
+go.opentelemetry.io/otel/trace v1.30.0/go.mod h1:5EyKqTzzmyqB9bwtCCq6pDLktPK6fmGf/Dph+8VI02o=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
-golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa h1:FRnLl4eNAQl8hwxVVC17teOw8kdjVDVAiFMtgUdTSRQ=
-golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa/go.mod h1:zk2irFbV9DP96SEBUUAy67IdHUaZuSnrz1n472HUCLE=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
+golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
 golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
 golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
diff --git a/dagger/localartifactmirror.go b/dagger/localartifactmirror.go
new file mode 100644
index 000000000..20449580f
--- /dev/null
+++ b/dagger/localartifactmirror.go
@@ -0,0 +1,140 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"dagger/embedded-cluster/internal/dagger"
+)
+
+// Builds the local artifact mirror image with APKO.
+func (m *EmbeddedCluster) BuildLocalArtifactMirrorImage(
+	// Source directory to use for the build.
+	// +defaultPath="/"
+	src *dagger.Directory,
+	// Repository to use for the image.
+	// +default="replicated/embedded-cluster-local-artifact-mirror"
+	repo string,
+	// Version to use for the package.
+	ecVersion string,
+	// Architectures to build for.
+	// +default="amd64,arm64"
+	arch string,
+) *dagger.File {
+
+	tag := strings.Replace(ecVersion, "+", "-", -1)
+	image := fmt.Sprintf("%s:%s", repo, tag)
+
+	apkoFile := m.apkoTemplateLocalArtifactMirror(src, ecVersion)
+
+	pkgBuild := m.BuildLocalArtifactMirrorPackage(src, ecVersion, arch)
+
+	dir := dag.Directory().
+		WithFile("melange.rsa.pub", pkgBuild.File("melange.rsa.pub")).
+		WithDirectory("packages", pkgBuild.Directory("packages"))
+
+	build := m.apkoBuild(
+		dir,
+		apkoFile,
+		image,
+		arch,
+		APKOImageVersion,
+	)
+
+	return build.File("apko.tar")
+}
+
+// Builds and publishes the local artifact mirror image with APKO.
+func (m *EmbeddedCluster) PublishLocalArtifactMirrorImage(
+	ctx context.Context,
+	// Source directory to use for the build.
+	// +defaultPath="/"
+	src *dagger.Directory,
+	// Repository to use for the image.
+	// +default="replicated/embedded-cluster-local-artifact-mirror"
+	repo string,
+	// Version to use for the package.
+	ecVersion string,
+	// Architectures to build for.
+	// +default="amd64,arm64"
+	arch string,
+) (string, error) {
+
+	tag := strings.Replace(ecVersion, "+", "-", -1)
+	image := fmt.Sprintf("%s:%s", repo, tag)
+
+	apkoFile := m.apkoTemplateLocalArtifactMirror(src, ecVersion)
+
+	pkgBuild := m.BuildLocalArtifactMirrorPackage(src, ecVersion, arch)
+
+	dir := dag.Directory().
+		WithFile("melange.rsa.pub", pkgBuild.File("melange.rsa.pub")).
+		WithDirectory("packages", pkgBuild.Directory("packages"))
+
+	publish := m.apkoPublish(
+		dir,
+		apkoFile,
+		image,
+		arch,
+		APKOImageVersion,
+	)
+
+	return publish.Stdout(ctx)
+}
+
+// Builds the local artifact mirror package with Melange.
+func (m *EmbeddedCluster) BuildLocalArtifactMirrorPackage(
+	// Source directory to use for the build.
+	// +defaultPath="/"
+	src *dagger.Directory,
+	// Version to use for the package.
+	ecVersion string,
+	// Architectures to build for.
+	// +default="amd64,arm64"
+	arch string,
+) *dagger.Directory {
+
+	melangeFile := m.melangeTemplateLocalArtifactMirror(src, ecVersion)
+
+	dir := dag.Directory().
+		WithDirectory("local-artifact-mirror", src.Directory("local-artifact-mirror")).
+		WithDirectory("cmd", src.Directory("cmd"))
+
+	build := m.melangeBuildGo(
+		directoryWithCommonGoFiles(dir, src),
+		melangeFile,
+		arch,
+		MelangeImageVersion,
+	)
+
+	return build.Directory("build")
+}
+
+func (m *EmbeddedCluster) apkoTemplateLocalArtifactMirror(
+	src *dagger.Directory,
+	ecVersion string,
+) *dagger.File {
+	return m.renderTemplate(
+		src.Directory("local-artifact-mirror/deploy"),
+		map[string]string{
+			"PACKAGE_VERSION": ecVersion,
+		},
+		"apko.tmpl.yaml",
+		"apko.yaml",
+	)
+}
+
+func (m *EmbeddedCluster) melangeTemplateLocalArtifactMirror(
+	src *dagger.Directory,
+	ecVersion string,
+) *dagger.File {
+	return m.renderTemplate(
+		src.Directory("local-artifact-mirror/deploy"),
+		map[string]string{
+			"PACKAGE_VERSION": ecVersion,
+		},
+		"melange.tmpl.yaml",
+		"melange.yaml",
+	)
+}
diff --git a/dagger/main.go b/dagger/main.go
index 83f623a26..090aa1e3a 100644
--- a/dagger/main.go
+++ b/dagger/main.go
@@ -1,53 +1,15 @@
 package main
 
-import (
-	"context"
-
-	"dagger/embedded-cluster/internal/dagger"
-)
+import "dagger/embedded-cluster/internal/dagger"
 
 const (
+	APKOImageVersion    = "latest"
 	MelangeImageVersion = "latest"
 )
 
 type EmbeddedCluster struct {
 	common
-	melange
-}
-
-// Builds the operator package with Melange.
-func (m *EmbeddedCluster) BuildOperatorPackage(
-	ctx context.Context,
-	// Source directory to use for the build.
-	// +defaultPath="/"
-	src *dagger.Directory,
-	// Version to use for the package.
-	ecVersion string,
-	// Architectures to build for.
-	// +default="amd64,arm64"
-	arch string,
-) *dagger.Directory {
-
-	melangeFile := m.renderTemplate(
-		src.Directory("operator/deploy"),
-		map[string]string{
-			"PACKAGE_VERSION": ecVersion,
-		},
-		"melange.tmpl.yaml",
-		"melange.yaml",
-	)
-
-	dir := dag.Directory().
-		WithDirectory("operator", src.Directory("operator"))
-
-	build := m.melangeBuildGo(ctx,
-		directoryWithCommonGoFiles(dir, src),
-		melangeFile,
-		arch,
-		MelangeImageVersion,
-	)
-
-	return build.Directory("build")
+	chainguard
 }
 
 // directoryWithCommonGoFiles sets up the filesystem with only what we need to build for improved
diff --git a/dagger/melange.go b/dagger/melange.go
deleted file mode 100644
index dfdaba1f0..000000000
--- a/dagger/melange.go
+++ /dev/null
@@ -1,60 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-
-	"dagger/embedded-cluster/internal/dagger"
-)
-
-type melange struct{}
-
-func (m *melange) melangeBuildGo(
-	ctx context.Context,
-	src *dagger.Directory,
-	melangeFile *dagger.File,
-	// +default="amd64,arm64"
-	arch string,
-	// +default="latest"
-	imageTag string,
-) *dagger.Container {
-
-	keygen := m.melangeKeygen(ctx, imageTag)
-
-	c := dag.Container().
-		From(fmt.Sprintf("cgr.dev/chainguard/melange:%s", imageTag)).
-		WithDirectory("/workspace", src).
-		WithFile("/workspace/melange.yaml", melangeFile).
-		WithFile("/workspace/melange.rsa", keygen.File("/workspace/melange.rsa")).
-		WithFile("/workspace/build/melange.rsa.pub", keygen.File("/workspace/melange.rsa.pub")).
-		WithMountedCache("/go/pkg/mod", dag.CacheVolume("go-mod")).
-		WithWorkdir("/workspace").
-		WithExec(
-			[]string{
-				"melange", "build", "melange.yaml",
-				"--signing-key", "melange.rsa",
-				"--cache-dir", "/go/pkg/mod",
-				"--arch", arch,
-				"--out-dir", "build/packages/",
-			},
-			dagger.ContainerWithExecOpts{
-				ExperimentalPrivilegedNesting: true,
-				InsecureRootCapabilities:      true,
-			},
-		)
-
-	return c
-}
-
-func (m *melange) melangeKeygen(
-	ctx context.Context,
-	// +default="latest"
-	imageTag string,
-) *dagger.Container {
-	keygen := dag.Container().
-		From(fmt.Sprintf("cgr.dev/chainguard/melange:%s", imageTag)).
-		WithWorkdir("/workspace").
-		WithExec([]string{"melange", "keygen"})
-
-	return keygen
-}
diff --git a/dagger/operator.go b/dagger/operator.go
new file mode 100644
index 000000000..7591a18ca
--- /dev/null
+++ b/dagger/operator.go
@@ -0,0 +1,139 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"dagger/embedded-cluster/internal/dagger"
+)
+
+// Builds the operator image with APKO.
+func (m *EmbeddedCluster) BuildOperatorImage(
+	// Source directory to use for the build.
+	// +defaultPath="/"
+	src *dagger.Directory,
+	// Repository to use for the image.
+	// +default="replicated/embedded-cluster-operator-image"
+	repo string,
+	// Version to use for the package.
+	ecVersion string,
+	// Architectures to build for.
+	// +default="amd64,arm64"
+	arch string,
+) *dagger.File {
+
+	tag := strings.Replace(ecVersion, "+", "-", -1)
+	image := fmt.Sprintf("%s:%s", repo, tag)
+
+	apkoFile := m.apkoTemplateOprator(src, ecVersion)
+
+	pkgBuild := m.BuildOperatorPackage(src, ecVersion, arch)
+
+	dir := dag.Directory().
+		WithFile("melange.rsa.pub", pkgBuild.File("melange.rsa.pub")).
+		WithDirectory("packages", pkgBuild.Directory("packages"))
+
+	build := m.apkoBuild(
+		dir,
+		apkoFile,
+		image,
+		arch,
+		APKOImageVersion,
+	)
+
+	return build.File("apko.tar")
+}
+
+// Builds and publishes the operator image with APKO.
+func (m *EmbeddedCluster) PublishOperatorImage(
+	ctx context.Context,
+	// Source directory to use for the build.
+	// +defaultPath="/"
+	src *dagger.Directory,
+	// Repository to use for the image.
+	// +default="replicated/embedded-cluster-operator-image"
+	repo string,
+	// Version to use for the package.
+	ecVersion string,
+	// Architectures to build for.
+	// +default="amd64,arm64"
+	arch string,
+) (string, error) {
+
+	tag := strings.Replace(ecVersion, "+", "-", -1)
+	image := fmt.Sprintf("%s:%s", repo, tag)
+
+	apkoFile := m.apkoTemplateOprator(src, ecVersion)
+
+	pkgBuild := m.BuildOperatorPackage(src, ecVersion, arch)
+
+	dir := dag.Directory().
+		WithFile("melange.rsa.pub", pkgBuild.File("melange.rsa.pub")).
+		WithDirectory("packages", pkgBuild.Directory("packages"))
+
+	build := m.apkoPublish(
+		dir,
+		apkoFile,
+		image,
+		arch,
+		APKOImageVersion,
+	)
+
+	return build.Stdout(ctx)
+}
+
+// Builds the operator package with Melange.
+func (m *EmbeddedCluster) BuildOperatorPackage(
+	// Source directory to use for the build.
+	// +defaultPath="/"
+	src *dagger.Directory,
+	// Version to use for the package.
+	ecVersion string,
+	// Architectures to build for.
+	// +default="amd64,arm64"
+	arch string,
+) *dagger.Directory {
+
+	melangeFile := m.melangeTemplateOperator(src, ecVersion)
+
+	dir := dag.Directory().
+		WithDirectory("operator", src.Directory("operator"))
+
+	build := m.melangeBuildGo(
+		directoryWithCommonGoFiles(dir, src),
+		melangeFile,
+		arch,
+		MelangeImageVersion,
+	)
+
+	return build.Directory("build")
+}
+
+func (m *EmbeddedCluster) apkoTemplateOprator(
+	src *dagger.Directory,
+	ecVersion string,
+) *dagger.File {
+	return m.renderTemplate(
+		src.Directory("operator/deploy"),
+		map[string]string{
+			"PACKAGE_VERSION": ecVersion,
+		},
+		"apko.tmpl.yaml",
+		"apko.yaml",
+	)
+}
+
+func (m *EmbeddedCluster) melangeTemplateOperator(
+	src *dagger.Directory,
+	ecVersion string,
+) *dagger.File {
+	return m.renderTemplate(
+		src.Directory("operator/deploy"),
+		map[string]string{
+			"PACKAGE_VERSION": ecVersion,
+		},
+		"melange.tmpl.yaml",
+		"melange.yaml",
+	)
+}
diff --git a/deploy/README.md b/deploy/README.md
index 092d66490..5d160ae8e 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -13,7 +13,7 @@ Images can be built with provided melange and apko make commands:
 ``` bash
 make melange-build apko-build \
     IMAGE=ttl.sh/$(id -u -n)/local-artifact-mirror:24h
-    VERSION=1.0.0
+    PACKAGE_VERSION=1.0.0
     MELANGE_CONFIG=deploy/packages/local-artifact-mirror/melange.tmpl.yaml
     APKO_CONFIG=deploy/images/local-artifact-mirror/apko.tmpl.yaml
 ```
diff --git a/kinds/go.mod b/kinds/go.mod
index 65c8e3994..a33828cc1 100644
--- a/kinds/go.mod
+++ b/kinds/go.mod
@@ -6,8 +6,8 @@ require (
 	github.com/evanphx/json-patch v5.9.0+incompatible
 	github.com/k0sproject/k0s v1.29.9-0.20240821114611-d76eb6bb05a7
 	github.com/stretchr/testify v1.9.0
-	k8s.io/api v0.31.0
-	k8s.io/apimachinery v0.31.0
+	k8s.io/api v0.31.1
+	k8s.io/apimachinery v0.31.1
 	sigs.k8s.io/controller-runtime v0.19.0
 	sigs.k8s.io/yaml v1.4.0
 )
@@ -38,16 +38,17 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/mod v0.21.0 // indirect
+	golang.org/x/net v0.29.0 // indirect
 	golang.org/x/sys v0.25.0 // indirect
 	golang.org/x/text v0.18.0 // indirect
 	golang.org/x/tools v0.24.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	helm.sh/helm/v3 v3.15.4 // indirect
-	k8s.io/apiextensions-apiserver v0.31.0 // indirect
-	k8s.io/client-go v0.31.0 // indirect
+	helm.sh/helm/v3 v3.16.1 // indirect
+	k8s.io/apiextensions-apiserver v0.31.1 // indirect
+	k8s.io/client-go v0.31.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
diff --git a/kinds/go.sum b/kinds/go.sum
index 5730dce2e..37094f65b 100644
--- a/kinds/go.sum
+++ b/kinds/go.sum
@@ -87,14 +87,14 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
-golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/mod v0.21.0 h1:vvrHzRwRfVKSiLrG+d4FMl/Qi4ukBCE6kZlTUkDYRT0=
+golang.org/x/mod v0.21.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.28.0 h1:a9JDOJc5GMUJ0+UDqmLT86WiEy7iWyIhz8gz8E4e5hE=
-golang.org/x/net v0.28.0/go.mod h1:yqtgsTWOOnlGLG9GFRrK3++bGOUEkNBoHZc8MEDWPNg=
+golang.org/x/net v0.29.0 h1:5ORfpBpCs4HzDYoodCDBbwHzdR5UrLBZ3sOnUJmFoHo=
+golang.org/x/net v0.29.0/go.mod h1:gLkgy8jTGERgjzMic6DS9+SP0ajcu6Xu3Orq/SpETg0=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -131,16 +131,16 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-helm.sh/helm/v3 v3.15.4 h1:UFHd6oZ1IN3FsUZ7XNhOQDyQ2QYknBNWRHH57e9cbHY=
-helm.sh/helm/v3 v3.15.4/go.mod h1:phOwlxqGSgppCY/ysWBNRhG3MtnpsttOzxaTK+Mt40E=
-k8s.io/api v0.31.0 h1:b9LiSjR2ym/SzTOlfMHm1tr7/21aD7fSkqgD/CVJBCo=
-k8s.io/api v0.31.0/go.mod h1:0YiFF+JfFxMM6+1hQei8FY8M7s1Mth+z/q7eF1aJkTE=
-k8s.io/apiextensions-apiserver v0.31.0 h1:fZgCVhGwsclj3qCw1buVXCV6khjRzKC5eCFt24kyLSk=
-k8s.io/apiextensions-apiserver v0.31.0/go.mod h1:b9aMDEYaEe5sdK+1T0KU78ApR/5ZVp4i56VacZYEHxk=
-k8s.io/apimachinery v0.31.0 h1:m9jOiSr3FoSSL5WO9bjm1n6B9KROYYgNZOb4tyZ1lBc=
-k8s.io/apimachinery v0.31.0/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
-k8s.io/client-go v0.31.0 h1:QqEJzNjbN2Yv1H79SsS+SWnXkBgVu4Pj3CJQgbx0gI8=
-k8s.io/client-go v0.31.0/go.mod h1:Y9wvC76g4fLjmU0BA+rV+h2cncoadjvjjkkIGoTLcGU=
+helm.sh/helm/v3 v3.16.1 h1:cER6tI/8PgUAsaJaQCVBUg3VI9KN4oVaZJgY60RIc0c=
+helm.sh/helm/v3 v3.16.1/go.mod h1:r+xBHHP20qJeEqtvBXMf7W35QDJnzY/eiEBzt+TfHps=
+k8s.io/api v0.31.1 h1:Xe1hX/fPW3PXYYv8BlozYqw63ytA92snr96zMW9gWTU=
+k8s.io/api v0.31.1/go.mod h1:sbN1g6eY6XVLeqNsZGLnI5FwVseTrZX7Fv3O26rhAaI=
+k8s.io/apiextensions-apiserver v0.31.1 h1:L+hwULvXx+nvTYX/MKM3kKMZyei+UiSXQWciX/N6E40=
+k8s.io/apiextensions-apiserver v0.31.1/go.mod h1:tWMPR3sgW+jsl2xm9v7lAyRF1rYEK71i9G5dRtkknoQ=
+k8s.io/apimachinery v0.31.1 h1:mhcUBbj7KUjaVhyXILglcVjuS4nYXiwC+KKFBgIVy7U=
+k8s.io/apimachinery v0.31.1/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/client-go v0.31.1 h1:f0ugtWSbWpxHR7sjVpQwuvw9a3ZKLXX0u0itkFXufb0=
+k8s.io/client-go v0.31.1/go.mod h1:sKI8871MJN2OyeqRlmA4W4KM9KBdBUpDLu/43eGemCg=
 k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
 k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
diff --git a/local-artifact-mirror/Makefile b/local-artifact-mirror/Makefile
index ee098a9ec..9b508806a 100644
--- a/local-artifact-mirror/Makefile
+++ b/local-artifact-mirror/Makefile
@@ -11,8 +11,6 @@ USE_CHAINGUARD ?= 1
 
 export PACKAGE_VERSION ?= $(VERSION)
 export IMAGE_NAME ?= replicated/embedded-cluster-local-artifact-mirror
-export IMAGE_TAG ?= $(shell echo "$(PACKAGE_VERSION)" | sed 's/+/-/')
-export IMAGE ?= $(IMAGE_NAME):$(IMAGE_TAG)
 
 .PHONY: build
 build:
@@ -22,50 +20,63 @@ build:
 		-ldflags="-s -w -extldflags=-static" \
 		-o bin/local-artifact-mirror-$(OS)-$(ARCH) ../cmd/local-artifact-mirror
 
-export MELANGE_CONFIG := deploy/melange.tmpl.yaml
+export APKO_CONFIG := deploy/apko.tmpl.yaml
 
 .PHONY: melange-build-local-artifact-mirror
 melange-build-local-artifact-mirror:
-	$(MAKE) melange-build MELANGE_SOURCE_DIR=../
-
-export APKO_CONFIG := deploy/apko.tmpl.yaml
+	dagger call build-local-artifact-mirror-package \
+		--ec-version $(PACKAGE_VERSION) \
+		--arch $(ARCH) \
+		export --path build
 
 .PHONY: build-local-artifact-mirror-image
 build-local-artifact-mirror-image:
-	if [ "$(USE_CHAINGUARD)" == "1" ]; then \
+	@if [ "$(USE_CHAINGUARD)" == "1" ]; then \
 		$(MAKE) build-local-artifact-mirror-image-chainguard; \
 	else \
 		$(MAKE) build-local-artifact-mirror-image-dockerfile; \
 	fi
 
 .PHONY: build-local-artifact-mirror-image-chainguard
-build-local-artifact-mirror-image-chainguard: melange-build-local-artifact-mirror apko-build
+build-local-artifact-mirror-image-chainguard:
+	dagger call build-local-artifact-mirror-image \
+		--ec-version $(PACKAGE_VERSION) \
+		--repo $(IMAGE_NAME) \
+		--arch $(ARCH) \
+		export --path build
 
 .PHONY: build-local-artifact-mirror-image-dockerfile
 build-local-artifact-mirror-image-dockerfile:
-	docker build --platform="$(OS)/$(ARCH)" -t $(IMAGE) -f ../dev/dockerfiles/local-artifact-mirror/Dockerfile.ttlsh ../
+	docker build --platform="$(OS)/$(ARCH)" -t "$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))" -f ../dev/dockerfiles/local-artifact-mirror/Dockerfile.ttlsh ../
 	mkdir -p build
-	echo "$(IMAGE)" > build/image
+	echo "$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))" > build/image
 
 .PHONY: build-and-push-local-artifact-mirror-image
 build-and-push-local-artifact-mirror-image:
-	if [ "$(USE_CHAINGUARD)" == "1" ]; then \
+	@if [ "$(USE_CHAINGUARD)" == "1" ]; then \
 		$(MAKE) build-and-push-local-artifact-mirror-image-chainguard; \
 	else \
 		$(MAKE) build-and-push-local-artifact-mirror-image-dockerfile; \
 	fi
 
 .PHONY: build-and-push-local-artifact-mirror-image-chainguard
-build-and-push-local-artifact-mirror-image-chainguard: melange-build-local-artifact-mirror apko-build-and-publish
+build-and-push-local-artifact-mirror-image-chainguard:
+	mkdir -p build
+	dagger call publish-local-artifact-mirror-image \
+		--ec-version $(PACKAGE_VERSION) \
+		--repo $(IMAGE_NAME) \
+		--arch $(ARCH) \
+		> build/digest
+	@$(MAKE) apko-output-image IMAGE="$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))"
 
 .PHONY: build-and-push-local-artifact-mirror-image-dockerfile
 build-and-push-local-artifact-mirror-image-dockerfile: build-local-artifact-mirror-image-dockerfile
-	docker push $(IMAGE)
+	docker push "$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))"
 
 .PHONY: build-ttl.sh
 build-ttl.sh:
-	$(MAKE) build-and-push-local-artifact-mirror-image \
-		IMAGE=ttl.sh/$(CURRENT_USER)/embedded-cluster-local-artifact-mirror:$(IMAGE_TAG)
+	@$(MAKE) build-and-push-local-artifact-mirror-image \
+		IMAGE_NAME=ttl.sh/$(CURRENT_USER)/embedded-cluster-local-artifact-mirror
 
 .PHONY: clean
 clean:
diff --git a/operator/Makefile b/operator/Makefile
index 2308f616d..73bd31bc7 100644
--- a/operator/Makefile
+++ b/operator/Makefile
@@ -132,70 +132,77 @@ $(ENVTEST): $(LOCALBIN)
 USE_CHAINGUARD ?= 1
 
 export PACKAGE_VERSION ?= $(VERSION)
-export IMAGE_NAMESPACE ?= replicated
-export IMAGE_NAME ?= $(IMAGE_NAMESPACE)/embedded-cluster-operator-image
-export IMAGE_TAG ?= $(shell echo "$(PACKAGE_VERSION)" | sed 's/+/-/')
-export IMAGE ?= $(IMAGE_NAME):$(IMAGE_TAG)
+export IMAGE_NAME ?= replicated/embedded-cluster-operator-image
 export CHART_REMOTE ?= oci://registry.replicated.com/library
 export CHART_VERSION ?= $(shell echo "$(PACKAGE_VERSION)" | sed 's/^v//')
 
-export MELANGE_CONFIG := deploy/melange.tmpl.yaml
+export APKO_CONFIG := deploy/apko.tmpl.yaml
 
 .PHONY: melange-build-operator
 melange-build-operator:
 	dagger call build-operator-package \
 		--ec-version $(PACKAGE_VERSION) \
 		--arch $(ARCH) \
-		export --path build/operator-package
-
-export APKO_CONFIG := deploy/apko.tmpl.yaml
+		export --path build
 
 .PHONY: build-operator-image
 build-operator-image:
-	if [ "$(USE_CHAINGUARD)" == "1" ]; then \
+	@if [ "$(USE_CHAINGUARD)" == "1" ]; then \
 		$(MAKE) build-operator-image-chainguard; \
 	else \
 		$(MAKE) build-operator-image-dockerfile; \
 	fi
 
 .PHONY: build-operator-image-chainguard
-build-operator-image-chainguard: melange-build-operator apko-build
+build-operator-image-chainguard:
+	dagger call build-operator-image \
+		--ec-version $(PACKAGE_VERSION) \
+		--repo $(IMAGE_NAME) \
+		--arch $(ARCH) \
+		export --path build/operator-package
 
 .PHONY: build-operator-image-dockerfile
 build-operator-image-dockerfile:
-	docker build --platform="$(OS)/$(ARCH)" -t $(IMAGE) -f ../dev/dockerfiles/operator/Dockerfile.ttlsh ../
+	docker build --platform="$(OS)/$(ARCH)" -t "$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))" -f ../dev/dockerfiles/operator/Dockerfile.ttlsh ../
 	mkdir -p build
-	echo "$(IMAGE)" > build/image
+	echo "$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))" > build/image
 
 .PHONY: build-and-push-operator-image
 build-and-push-operator-image:
-	if [ "$(USE_CHAINGUARD)" == "1" ]; then \
+	@if [ "$(USE_CHAINGUARD)" == "1" ]; then \
 		$(MAKE) build-and-push-operator-image-chainguard; \
 	else \
 		$(MAKE) build-and-push-operator-image-dockerfile; \
 	fi
 
 .PHONY: build-and-push-operator-image-chainguard
-build-and-push-operator-image-chainguard: melange-build-operator apko-build-and-publish
+build-and-push-operator-image-chainguard:
+	mkdir -p build
+	dagger call publish-operator-image \
+		--ec-version $(PACKAGE_VERSION) \
+		--repo $(IMAGE_NAME) \
+		--arch $(ARCH) \
+		> build/digest
+	@$(MAKE) apko-output-image IMAGE="$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))"
 
 .PHONY: build-and-push-operator-image-dockerfile
 build-and-push-operator-image-dockerfile: build-operator-image-dockerfile
-	docker push $(IMAGE)
+	docker push "$(IMAGE_NAME):$(call image-tag,$(PACKAGE_VERSION))"
 
 .PHONY: build-chart
 build-chart:
-	cd charts/embedded-cluster-operator && ../../scripts/publish-helm-chart.sh
+	cd charts/embedded-cluster-operator && IMAGE_TAG=$(call image-tag,$(PACKAGE_VERSION)) ../../scripts/publish-helm-chart.sh
 	mkdir -p build
 	echo "$(CHART_REMOTE)/embedded-cluster-operator:$(CHART_VERSION)" > build/chart
 
 .PHONY: build-ttl.sh
 build-ttl.sh:
-	$(MAKE) build-and-push-operator-image \
-		IMAGE=ttl.sh/$(CURRENT_USER)/embedded-cluster-operator-image:$(IMAGE_TAG)
+	@$(MAKE) build-and-push-operator-image \
+		IMAGE_NAME=ttl.sh/$(CURRENT_USER)/embedded-cluster-operator-image
 
 .PHONY: build-chart-ttl.sh
 build-chart-ttl.sh:
-	$(MAKE) build-chart \
+	@$(MAKE) build-chart \
 		IMAGE_NAME=ttl.sh/$(CURRENT_USER)/embedded-cluster-operator-image \
 		CHART_REMOTE=oci://ttl.sh/$(CURRENT_USER)
 
diff --git a/operator/deploy/apko.tmpl.yaml b/operator/deploy/apko.tmpl.yaml
index 4c032102d..57398969e 100644
--- a/operator/deploy/apko.tmpl.yaml
+++ b/operator/deploy/apko.tmpl.yaml
@@ -1,10 +1,10 @@
 contents:
   repositories:
     - https://packages.wolfi.dev/os
-    - ./operator-package/packages/
+    - ./packages/
   keyring:
     - https://packages.wolfi.dev/os/wolfi-signing.rsa.pub
-    - ./operator-package/melange.rsa.pub
+    - ./melange.rsa.pub
   packages:
     - embedded-cluster-operator  # This is expected to be built locally by `melange`.
     - ca-certificates-bundle