diff --git a/.circleci/config.yml b/.circleci/config.yml
index 5541f5fa154c2..a79f29235c893 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -12,12 +12,9 @@ jobs:
      steps:
        - checkout
        - run: ci/do_circle_ci.sh bazel.release
-       - run: ci/do_circle_ci.sh github_release
        - setup_remote_docker
        - run: ci/docker_push.sh
        - run: ci/docker_tag.sh
-       - store_artifacts:
-          path: /tmp/envoy-dist
    asan:
      docker:
        - image: *envoy-build-image
diff --git a/ci/do_ci.sh b/ci/do_ci.sh
index 562dffb460f7b..fe6a2428fc2ee 100755
--- a/ci/do_ci.sh
+++ b/ci/do_ci.sh
@@ -20,11 +20,9 @@ function bazel_release_binary_build() {
   # TODO(mattklein123): Replace this with caching and a different job which creates images.
   echo "Copying release binary for image build..."
   mkdir -p "${ENVOY_SRCDIR}"/build_release
-  mkdir -p /tmp/envoy-dist
   cp -f "${ENVOY_DELIVERY_DIR}"/envoy "${ENVOY_SRCDIR}"/build_release
   mkdir -p "${ENVOY_SRCDIR}"/build_release_stripped
   strip "${ENVOY_DELIVERY_DIR}"/envoy -o "${ENVOY_SRCDIR}"/build_release_stripped/envoy
-  cp "${ENVOY_SRCDIR}"/build_release_stripped/envoy /tmp/envoy-dist/envoy
 }
 
 function bazel_debug_binary_build() {
@@ -39,6 +37,14 @@ function bazel_debug_binary_build() {
 }
 
 if [[ "$1" == "bazel.release" ]]; then
+  # The release build step still runs during tag events. Avoid rebuilding for no reason.
+  # TODO(mattklein123): Consider moving this into its own "build".
+  if [[ -n "$CIRCLE_TAG" ]]
+  then
+    echo 'Ignoring build for git tag event'
+    exit 0
+  fi
+
   setup_gcc_toolchain
   echo "bazel release build with tests..."
   bazel_release_binary_build
@@ -161,8 +167,6 @@ elif [[ "$1" == "check_format" ]]; then
 elif [[ "$1" == "docs" ]]; then
   docs/publish.sh
   exit 0
-elif [[ "$1" == "github_release" ]]; then
-  ./ci/publish_github_release.sh
 else
   echo "Invalid do_ci.sh target, see ci/README.md for valid targets."
   exit 1
diff --git a/ci/do_circle_ci.sh b/ci/do_circle_ci.sh
index 5f05b6e9492df..0d198f282f156 100755
--- a/ci/do_circle_ci.sh
+++ b/ci/do_circle_ci.sh
@@ -2,11 +2,9 @@
 
 set -e
 
-if [[ -f ~/.gitconfig ]]; then
-  # bazel uses jgit internally and the default circle-ci .gitconfig says to
-  # convert https://github.com to ssh://git@github.com, which jgit does not support.
-  mv ~/.gitconfig ~/.gitconfig_save
-fi
+# bazel uses jgit internally and the default circle-ci .gitconfig says to
+# convert https://github.com to ssh://git@github.com, which jgit does not support.
+mv ~/.gitconfig ~/.gitconfig_save
 
 export ENVOY_SRCDIR="$(pwd)"
 
diff --git a/ci/publish_github_release.sh b/ci/publish_github_release.sh
deleted file mode 100755
index 7ea0adee0f230..0000000000000
--- a/ci/publish_github_release.sh
+++ /dev/null
@@ -1,37 +0,0 @@
-#!/bin/bash
-
-# NOTE: please do not set trace mode (-x)
-# as it will leak credentials in the logs.
-set -e
-
-if [[ -z "${CIRCLE_TAG:-}" ]]; then
-    echo "skipping non tag events"
-    exit 0
-fi
-
-if [[ ! -f "${ENVOY_SRCDIR}/build_release_stripped/envoy" ]]; then
-    echo "could not locate envoy binary at path: ${ENVOY_SRCDIR}/build_release_stripped/envoy"
-    exit 1
-fi
-
-if [[ -z "${GITHUB_TOKEN:-}" ]]; then
-    echo "environment variable GITHUB_TOKEN unset; cannot continue with publishing."
-    exit 1
-fi
-
-if [[ -z "${GITHUB_USER:-}" ]]; then
-    echo "environment variable GITHUB_USER unset; cannot continue with publishing."
-    exit 1
-fi
-
-if [[ -z "${GITHUB_REPO:-}" ]]; then
-    echo "environment variable GITHUB_REPO unset; cannot continue with publishing."
-    exit 1
-fi
-
-wget https://github.com/aktau/github-release/releases/download/v0.7.2/linux-amd64-github-release.tar.bz2 -O /tmp/ghrelease.tar.bz2
-tar -xvjpf /tmp/ghrelease.tar.bz2 -C /tmp
-cp /tmp/bin/linux/amd64/github-release /usr/local/bin/ghrelease
-chmod +x /usr/local/bin/ghrelease
-
-ghrelease upload --tag "${CIRCLE_TAG:-}" --name "envoy-linux-amd64" --file "${ENVOY_SRCDIR}/build_release_stripped/envoy"