diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c9adf60..ec0d26c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,18 +32,9 @@ jobs:
         run: make lint
 
       - name: test
-        run: make test
+        run: make up test rm
 
-      - name: Login to Docker Hub
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Push image to docker hub
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
         run: |
           make push_images
-        env:
-          DOCKER_USERNAME: internetstandards
-          secure: U7kSLhWutEWne8w0zMUN3XzWWWHnK0NKuDxrKQBtYpH5VA+ROd0js7y9uFYflqdJO/doiXE4updVM8D1aGrxfJ8Wp2Ywp5vC/6Ua+Wn+pdIi2WNBqOgCeq3+2NUMND7DpChFIA9dBiEOCnnOlRKYaz5bBhOR7trruV2E+QSCG+Scxejg+pToF/cRsQDI9zTktAr9rfWDfOjz0jfxC2NixOP8THFZhDW/vXlRWWGtmwvnawwXMdyhRYnIV/fvb2RnHeVlDXckMm+GTEcRwKZTp1Cy/lCuk8zEzxPkSvrYnAeC8Dto/KPFo9XnRNKNPygf4t7YlJ8eGvw7sp5QKH327D8+1kjspq20Aqq7IoHSHnhmYGrJSsgmoWsod6Be8PaFV/FjjfDbMvcpNspVxSPQu/h0P0POdK3+0HJBQ0j1qaYlOwlKGFyoNEN+hPOg7A/RWeV+P5wn5SxZCepL4T95uS4JIsb7SMmD1GxRTr+6ygRrKOnduBtBXFV48LALxvAwvBTka9muo924HDNsRQiI0r5gizoNPPTw+T8tzynoc7QRalih03UnEVvRxuPPz+kF+GyXQYLjVRIuPlrubnprOuW31VYEgwzAv32Ec3OZoUvx6MQvSvsignklSJgg9pucMu6apQPNkyt8GPRgUKUqQscPY1mSMhblWnaPAu7my9w=
diff --git a/Makefile b/Makefile
index 7992727..ccc077f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,22 +1,32 @@
 SHELL = /bin/bash
 
+ctlssa = docker compose exec -ti app
 dev = docker compose --profile=dev run -i --rm dev
 db = docker compose exec -i db
 
 # run this before/after checking in/out the source
-all: build lint test
+all: build lint up test
 
 # run the entire project
-run up:
+run:
 	docker compose up --remove-orphans --watch
 
+up:
+	docker compose up --remove-orphans --detach
+
+down:
+	docker compose down --remove-orphans
+
+rm:
+	docker compose rm --force --stop
+
 # make migration files
 makemigrations:
-	${dev} "ctlssa makemigrations"
+	${ctlssa} "ctlssa makemigrations"
 
 # load testdatta fixture
 testdata:
-	${dev} "ctlssa loaddata testdata"
+	${ctlssa} "ctlssa loaddata testdata"
 
 # run development shell
 dev dev-shell shell:
@@ -62,7 +72,7 @@ build:
 	docker compose build ${build_args}
 
 push_images:
-	docker compose --push app certstream
+	docker compose push app certstream
 
 # remove all runtime state and cache from the project
 mrproper:
diff --git a/README.md b/README.md
index 024e9a9..3a89ca9 100644
--- a/README.md
+++ b/README.md
@@ -169,11 +169,11 @@ Run these commands before checking in. These should all pass without error.
 
 To run the test suite use:
 
-    make build test
+    make build up test
 
 To rerun tests every time a file changes use:
 
-    make build test-watch
+    make build up test-watch
 
 ### Development shell
 
diff --git a/compose.yml b/compose.yml
index 8d81a02..ea5fb20 100644
--- a/compose.yml
+++ b/compose.yml
@@ -1,10 +1,10 @@
 services:
   app:
-    image: internetstandards/ctlssa:latest
+    image: ghcr.io/internetstandards/ctlssa:latest
     build: &app_build
       context: .
       cache_from:
-        - internetstandards/ctlssa:latest
+        - ghcr.io/internetstandards/ctlssa:latest
         - type=gha
       cache_to:
         - type=gha
@@ -45,7 +45,7 @@ services:
   app-ingest:
     build: *app_build
     develop: *app_develop
-    image: internetstandards/ctlssa:latest
+    image: ghcr.io/internetstandards/ctlssa:latest
     environment:
       CTLSSA_SECRET_KEY: '1'
       CTLSSA_DJANGO_DATABASE: production
@@ -71,7 +71,7 @@ services:
   certstream:
     build:
       context: vendor/certstream
-    image: internetstandards/certstream
+    image: ghcr.io/internetstandards/certstream:latest
     environment:
       LOG_LEVEL: error
     restart: always
@@ -100,7 +100,7 @@ services:
   db-migrate:
     build: *app_build
     develop: *app_develop
-    image: internetstandards/ctlssa:latest
+    image: ghcr.io/internetstandards/ctlssa:latest
     restart: on-failure
     environment:
       CTLSSA_SECRET_KEY: '1'
@@ -124,9 +124,6 @@ services:
     volumes:
       - .:/src
       - ./.root:/root
-    depends_on:
-      app:
-        condition: service_healthy
 
     profiles:
       - dev