diff --git a/Makefile b/Makefile
index e5060f0..61934f7 100644
--- a/Makefile
+++ b/Makefile
@@ -14,8 +14,10 @@ S3_HASH := $(S3)/hashes/riju-$(T)-$(L)
 S3_CONFIG := $(S3)/config.json
 
 ifneq ($(CMD),)
+C_CMD := -c '$(CMD)'
 BASH_CMD := bash -c '$(CMD)'
 else
+C_CMD :=
 BASH_CMD :=
 endif
 
@@ -96,7 +98,8 @@ else
 endif
 
 ecr: # Authenticate to ECR (temporary credentials)
-	id="$$(aws sts get-caller-identity | jq .Account -r)"; aws ecr get-login-password --region us-west-1 | docker login --username AWS --password-stdin "$${id}.dkr.ecr.us-west-1.amazonaws.com"
+	aws ecr get-login-password | docker login --username AWS --password-stdin $(subst /riju,,$(DOCKER_REPO))
+	aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin $(subst /riju,,$(PUBLIC_DOCKER_REPO))
 
 ### Build packaging scripts
 
@@ -215,6 +218,10 @@ push: # I=<image> : Push Riju image to Docker registry
 	@: $${I} $${DOCKER_REPO}
 	docker tag riju:$(I) $(DOCKER_REPO):$(I)-$(IMAGE_HASH)
 	docker push $(DOCKER_REPO):$(I)-$(IMAGE_HASH)
+ifeq ($(I),ubuntu)
+	docker tag riju:$(I) $(PUBLIC_DOCKER_REPO):$(I)
+	docker push $(PUBLIC_DOCKER_REPO):$(I)
+endif
 	docker tag riju:$(I) $(DOCKER_REPO):$(I)
 	docker push $(DOCKER_REPO):$(I)
 
@@ -248,8 +255,8 @@ dockerignore: # Update .dockerignore from .gitignore and .dockerignore.in
 ## manual commands (Docker, Terraform, Packer, etc.) directly, as
 ## opposed to through the Makefile.
 
-env: # Run shell with .env file loaded and $PATH fixed
-	exec bash
+env: # [CMD=<target>] : Run shell with .env file loaded and $PATH fixed
+	exec bash $(C_CMD)
 
 tmux: # Start or attach to tmux session
 	MAKELEVEL= tmux attach || MAKELEVEL= tmux new-session -s tmux
diff --git a/tf/ecr.tf b/tf/ecr.tf
index 9202998..fd799d4 100644
--- a/tf/ecr.tf
+++ b/tf/ecr.tf
@@ -2,3 +2,8 @@ resource "aws_ecr_repository" "riju" {
   name                 = "riju"
   image_tag_mutability = "IMMUTABLE"
 }
+
+resource "aws_ecrpublic_repository" "riju" {
+  provider = aws.us_east_1
+  repository_name = "riju"
+}
diff --git a/tf/main.tf b/tf/main.tf
index d32bec5..8be2123 100644
--- a/tf/main.tf
+++ b/tf/main.tf
@@ -35,6 +35,16 @@ provider "aws" {
   }
 }
 
+provider "aws" {
+  alias = "us_east_1"
+  region = "us-east-1"
+  default_tags {
+    tags = local.tags
+  }
+}
+
+data "aws_caller_identity" "current" {}
+
 data "aws_region" "current" {}
 
 data "aws_vpc" "default" {
diff --git a/tools/ci-run.bash b/tools/ci-run.bash
index 195412f..df8a00a 100755
--- a/tools/ci-run.bash
+++ b/tools/ci-run.bash
@@ -5,4 +5,4 @@ set -euo pipefail
 echo "${DOCKER_PASSWORD}" | sudo -E docker login --username "${DOCKER_USERNAME}" --password-stdin
 
 make system
-make publish Z=xz CI=1 TEST_PATIENCE=4 TEST_CONCURRENCY=1
+make env CMD="dep deploy:live --publish --all" Z=xz CI=1 TEST_PATIENCE=4 TEST_CONCURRENCY=1