diff --git a/tools/plan-publish.js b/tools/plan-publish.js
index 1ae6624..53103f7 100644
--- a/tools/plan-publish.js
+++ b/tools/plan-publish.js
@@ -36,9 +36,17 @@ async function planDockerImage(name, dependentHashes, opts) {
     local,
     remote,
     download: async () => {
+      if (name === "app") {
+        // Magic string parsed by publish.bash
+        console.log("[for publish script: plan-publish is tagging app image]");
+      }
       await runCommand(`make pull I=${name}`);
     },
     build: async () => {
+      if (name === "app") {
+        // Magic string parsed by publish.bash
+        console.log("[for publish script: plan-publish is tagging app image]");
+      }
       await runCommand(`make image I=${name}`);
     },
     upload: async () => {
diff --git a/tools/publish.bash b/tools/publish.bash
index c14abe5..9e7f794 100755
--- a/tools/publish.bash
+++ b/tools/publish.bash
@@ -10,17 +10,6 @@ if [[ -z "${DEPLOY_SSH_PRIVATE_KEY:-}" ]]; then
     DEPLOY_SSH_PRIVATE_KEY="$(base64 < "${DEPLOY_SSH_PUBLIC_KEY_FILE%.pub}")"
 fi
 
-make pull-base scripts
-
-node tools/plan-publish.js --publish --show-all --omit-unneeded-downloads
-
-sha="$(git describe --match=always-omit-tag --always --abbrev=40 --dirty)"
-
-image="${DOCKER_REPO}:app-${sha}"
-
-docker tag "${DOCKER_REPO}:app" "${image}"
-docker push "${image}"
-
 tmpdir="$(mktemp -d)"
 
 function cleanup {
@@ -29,6 +18,23 @@ function cleanup {
 
 trap cleanup EXIT
 
+make pull-base scripts
+
+node tools/plan-publish.js --publish --show-all --omit-unneeded-downloads \
+    | tee "${tmpdir}/plan-publish.out"
+
+if ! grep -F "plan-publish is tagging app image" "${tmpdir}/plan-publish.out"; then
+    echo "publish.bash: no changes to app image, so not deploying" >&2
+    exit 0
+fi
+
+sha="$(git describe --match=always-omit-tag --always --abbrev=40 --dirty)"
+
+image="${DOCKER_REPO}:app-${sha}"
+
+docker tag "${DOCKER_REPO}:app" "${image}"
+docker push "${image}"
+
 base64 -d <<< "${DEPLOY_SSH_PRIVATE_KEY}" > "${tmpdir}/id"
 chmod go-rwx "${tmpdir}/id"