diff --git a/README.md b/README.md
index f504fcd..f5324c9 100644
--- a/README.md
+++ b/README.md
@@ -21,8 +21,7 @@ The normal flow builds on a temporary EC2 instance, so your local machine does
 not need to be the same architecture as the target AMI:
 
 ```bash
-cd tofu/ami-builder
-./publish-ami.sh --builder-instance-type t4g.large
+nix run ./tofu/ami-builder#publish-ami -- --builder-instance-type t4g.large
 ```
 
 `publish-ami.sh` applies this OpenTofu project to create a temporary builder
@@ -42,7 +41,7 @@ deregistering the AMI.
 Pass extra OpenTofu variables after `--`:
 
 ```bash
-./publish-ami.sh --builder-instance-type t4g.large -- \
+nix run ./tofu/ami-builder#publish-ami -- --builder-instance-type t4g.large -- \
   -var base_nixos_ami_id=ami-...
 ```
 
diff --git a/flake.nix b/flake.nix
index 016ae4e..6256f05 100644
--- a/flake.nix
+++ b/flake.nix
@@ -72,11 +72,32 @@
               exec ${pkgs.nodejs_24}/bin/node ${ami-artifacts-script}/libexec/ami-artifacts/manage-amis.mjs "$@"
             '';
           };
+          publish-ami = pkgs.writeShellApplication {
+            name = "publish-ami";
+            runtimeInputs = [
+              pkgs.awscli2
+              pkgs.coreutils
+              pkgs.git
+              pkgs.jq
+              pkgs.opentofu
+            ];
+            text = ''
+              git_root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+              if [ -d "$git_root/tofu/ami-builder" ]; then
+                ami_builder_dir="$git_root/tofu/ami-builder"
+              else
+                ami_builder_dir="$git_root"
+              fi
+              cd "$ami_builder_dir"
+              exec ./publish-ami.sh "$@"
+            '';
+          };
         in
         {
           rootImage = config.system.build.images.amazon;
           systemClosure = config.system.build.toplevel;
           ami-artifacts = ami-artifacts;
+          publish-ami = publish-ami;
           default = ami-artifacts;
         });
 
@@ -85,6 +106,10 @@
           type = "app";
           program = "${self.packages.${system}.ami-artifacts}/bin/ami-artifacts";
         };
+        publish-ami = {
+          type = "app";
+          program = "${self.packages.${system}.publish-ami}/bin/publish-ami";
+        };
       });
     };
 }