diff --git a/hack/build-image.sh b/hack/build-image.sh
index e5c7ff0a2d..8a116e6771 100755
--- a/hack/build-image.sh
+++ b/hack/build-image.sh
@@ -15,7 +15,7 @@ function print_info {
 
 # Warn when unprivileged
 if [ `id --user` -ne 0 ]; then
-	print_error "Note: Building unprivileged may fail due to permissions"
+	print_info "Building unprivileged may fail due to permissions"
 fi
 
 # Record all images files
@@ -35,6 +35,13 @@ if [ -z ${WHAT+a} ]; then
 	exit 1
 fi
 
+# Our change detection uses the git sha1
+# if ! git diff --quiet --exit-code; then
+#     print_error "Outstanding uncommitted changes found (git diff)"
+#     exit 1
+# fi
+
+VERSION=$(git describe --tags --abbrev=12 --always)
 
 # If all is the WHAT target then set TOBUILD to all the images found
 if [ ${WHAT} == "all" ]; then
@@ -64,5 +71,10 @@ for IMAGE_TO_BUILD in $TOBUILD; do
 	NAME="${IMAGE_TO_BUILD#Dockerfile.}"
   NAME="${NAME//.upstream}"
 	set -x
-	$podman build -t "localhost/${NAME}:latest" -f "${IMAGE_TO_BUILD}" --no-cache
+  imgname="localhost/${NAME}:${VERSION}"
+  if $podman inspect ${imgname} &>/dev/null; then
+      echo "Already built ${imgname}"
+  else
+	    $podman build -t "${imgname}" -f "${IMAGE_TO_BUILD}" --no-cache
+  fi
 done
diff --git a/hack/cluster-cvo-push.sh b/hack/cluster-cvo-push.sh
new file mode 100755
index 0000000000..0cc3acde29
--- /dev/null
+++ b/hack/cluster-cvo-push.sh
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Build all images and push to to the cluster registry, then
+# build a release image referencing them and start an upgrade to that.
+# You must have first run `cluster-push-prep.sh` once.
+# Assumptions: You have set KUBECONFIG to point to your local cluster,
+# and you have exposed the registry via e.g.
+# https://github.com/openshift/installer/issues/411#issuecomment-445165262
+
+set -xeuo pipefail
+
+do_build=1
+if [ "${1:-}" = "-n" ]; then
+    do_build=0
+fi
+
+NS=openshift-machine-config-operator
+COMPONENTS="operator controller server daemon"
+podman=${podman:-podman}
+
+internal_registry="image-registry.openshift-image-registry.svc:5000"
+internal_registry_ns="${internal_registry}/${NS}"
+registry=$(oc get -n openshift-image-registry -o json route/image-registry | jq -r ".spec.host")
+curl -k --head https://"${registry}" >/dev/null
+registry_ns="${registry}/${NS}"
+
+running_version=$(oc get clusterversion -o=jsonpath='{.items[0].status.desired.image}')
+
+# Keep in sync with build-image.sh
+VERSION=$(git describe --tags --abbrev=12 --always)
+if [ "${do_build}" = 1 ]; then
+    make images
+fi
+declare -A imgbuilds
+for c in $COMPONENTS; do
+    imgname="machine-config-${c}:${VERSION}"
+    remote_name=${registry_ns}/${imgname}
+    $podman push --tls-verify=false localhost/${imgname} ${remote_name}
+    digest=$(skopeo inspect --tls-verify=false docker://${remote_name} | jq -r .Digest)
+    imgbuilds[$c]="${digest}"
+done
+
+updateimg=${internal_registry_ns}/mcodev:latest
+cmd="oc adm release new --from-release ${running_version} --to-image=${updateimg} \
+   machine-config-operator=${internal_registry_ns}/machine-config-operator:${VERSION} \
+   machine-config-controller=${internal_registry_ns}/machine-config-controller:${VERSION} \
+   machine-config-server=${internal_registry_ns}/machine-config-server:${VERSION} \
+   machine-config-daemon=${internal_registry_ns}/machine-config-daemon:${VERSION} && \
+   oc adm upgrade --to-image ${updateimg} --force"
+cli_image=$(oc -n openshift-cluster-version rsh deploy/cluster-version-operator cluster-version-operator image cli)
+oc -n openshift-cluster-version create -f - <<EOF
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: mco-build-update-image
+spec:
+  template:
+    spec:
+      containers:
+      - name: mco-build-update-image
+        image: ${cli_image}
+        command: ["/bin/sh", "-c", "${cmd}"]
+      restartPolicy: Never
+EOF
+
+
+
diff --git a/hack/cluster-push-prep.sh b/hack/cluster-push-prep.sh
index 56149eacba..4b3368bcaf 100755
--- a/hack/cluster-push-prep.sh
+++ b/hack/cluster-push-prep.sh
@@ -11,7 +11,6 @@ set -xeuo pipefail
 
 podman=${podman:-podman}
 
-oc -n openshift-cluster-version scale --replicas=0 deploy/cluster-version-operator
 if ! oc get -n openshift-image-registry route/image-registry &>/dev/null; then
     oc expose -n openshift-image-registry svc/image-registry
 fi
diff --git a/hack/cluster-push.sh b/hack/cluster-push.sh
index 3b64ab1b97..2c8d8722db 100755
--- a/hack/cluster-push.sh
+++ b/hack/cluster-push.sh
@@ -15,6 +15,8 @@ if [ "${1:-}" = "-n" ]; then
     do_build=0
 fi
 
+oc -n openshift-cluster-version scale --replicas=0 deploy/cluster-version-operator
+
 registry=$(oc get -n openshift-image-registry -o json route/image-registry | jq -r ".spec.host")
 curl -k --head https://"${registry}" >/dev/null