diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 5ab3f851d1..79e99297ca 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -43,5 +43,4 @@ docker-push:
   stage: deploy
   tags:
     - deployer
-  script:
-    - 'bash -c "$(nix-build --no-out-link ./docker-images.nix)"'
+  script: './hack/dockerpush.sh'
diff --git a/hack/dockerpush.sh b/hack/dockerpush.sh
new file mode 100755
index 0000000000..6273275122
--- /dev/null
+++ b/hack/dockerpush.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+./hack/populate_secrets.sh
+
+exec "$(nix-build --no-out-link ./docker-images.nix)"