diff --git a/.github/workflows/deploy-development.yml b/.github/workflows/deploy-development.yml
new file mode 100644
index 0000000..eff9720
--- /dev/null
+++ b/.github/workflows/deploy-development.yml
@@ -0,0 +1,43 @@
+---
+name: deploy
+
+on:
+  push:
+    branches:
+      - develop
+
+jobs:
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: login to ghcr
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: publish
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: ghcr.io/gsa/cf-backup-manager:development
+
+  deploy-development:
+    name: deploy (development)
+    environment: development
+    runs-on: ubuntu-latest
+    needs:
+      - publish
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+      - name: deploy
+        uses: usds/cloud-gov-cli@master
+        with:
+          command: push backup-manager --vars-file vars.development.yml --strategy rolling
+          org: gsa-datagov
+          space: development
+          user: ${{secrets.CF_SERVICE_USER}}
+          password: ${{secrets.CF_SERVICE_AUTH}}
diff --git a/.github/workflows/deploy-production.yml b/.github/workflows/deploy-production.yml
new file mode 100644
index 0000000..2f835f6
--- /dev/null
+++ b/.github/workflows/deploy-production.yml
@@ -0,0 +1,61 @@
+---
+name: deploy
+
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: login to ghcr
+        uses: docker/login-action@v1
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - name: publish
+        uses: docker/build-push-action@v2
+        with:
+          push: true
+          tags: ghcr.io/gsa/cf-backup-manager:latest
+
+  deploy-staging:
+    name: deploy (staging)
+    environment: staging
+    runs-on: ubuntu-latest
+    needs:
+      - publish
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+      - name: deploy
+        uses: usds/cloud-gov-cli@master
+        with:
+          command: push backup-manager --vars-file vars.staging.yml --strategy rolling
+          org: gsa-datagov
+          space: staging
+          user: ${{secrets.CF_SERVICE_USER}}
+          password: ${{secrets.CF_SERVICE_AUTH}}
+
+  deploy-production:
+    name: deploy (production)
+    environment: production
+    runs-on: ubuntu-latest
+    needs:
+      - deploy-staging
+    steps:
+      - name: checkout
+        uses: actions/checkout@v2
+      - name: deploy
+        uses: usds/cloud-gov-cli@master
+        with:
+          command: push backup-manager --vars-file vars.production.yml --strategy rolling
+          org: gsa-datagov
+          space: prod
+          user: ${{secrets.CF_SERVICE_USER}}
+          password: ${{secrets.CF_SERVICE_AUTH}}
diff --git a/README.md b/README.md
index 9134b03..e299c55 100644
--- a/README.md
+++ b/README.md
@@ -5,12 +5,7 @@ Cloud Foundry application to automate backup and restore of application back end
 ## Publishing the image
 
 The Cloud Foundry application uses a docker image published to this repository.
-New images are published on any push to `main` via GitHub Actions. Make sure
-these secrets are configured.
-
-Secret | Description
------- | -----------
-GITHUB_TOKEN | A GH personal access token with scope `write:packages`. |
+New images are published on any push to `main` via GitHub Actions.
 
 ## Contributing
 
diff --git a/manifest.yml b/manifest.yml
index 92f6a12..42ba611 100644
--- a/manifest.yml
+++ b/manifest.yml
@@ -1,10 +1,11 @@
 ---
 applications:
-  - name: datastore-backup
+  - name: backup-manager
     instances: 0
     docker:
-      image: docker.io/adborden/cf-datastore-backup
-    command: sleep 3600
+      image: ghcr.io/gsa/cf-backup-manager:((docker_tag))
+    command: sleep infinity
+    memory: 64M
     health-check-type: process
     no-route: true
     environment:
diff --git a/vars.development.yml b/vars.development.yml
new file mode 100644
index 0000000..514546f
--- /dev/null
+++ b/vars.development.yml
@@ -0,0 +1,2 @@
+---
+docker_tag: development
diff --git a/vars.production.yml b/vars.production.yml
new file mode 100644
index 0000000..316e4ab
--- /dev/null
+++ b/vars.production.yml
@@ -0,0 +1,2 @@
+---
+docker_tag: latest
diff --git a/vars.staging.yml b/vars.staging.yml
new file mode 100644
index 0000000..316e4ab
--- /dev/null
+++ b/vars.staging.yml
@@ -0,0 +1,2 @@
+---
+docker_tag: latest