diff --git a/deploy/worker.yaml b/deploy/worker.yaml
new file mode 100644
index 0000000..d064fa4
--- /dev/null
+++ b/deploy/worker.yaml
@@ -0,0 +1,67 @@
+# Copyright 2022 The Go Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style
+# license that can be found in the LICENSE file.
+
+# This is a Cloud Build config file for the vuln worker.
+# Invoke locally from the command line using devtools/deploy_worker.sh.
+# It can also be configured to run from a trigger, by supplying the _ENV
+# substitution.
+
+substitutions:
+  _ENV: ''
+
+steps:
+  - id: Test
+    name: golang:1.17.3
+    entrypoint: bash
+    args:
+      - -ec
+      - go test ./...
+
+  - id: Prepare
+    name: bash
+    args:
+      - -ec
+      - |
+        if [[ "$SHORT_SHA" = '' ]]; then
+          echo >&2 "missing SHORT_SHA; use --substitutions on command line"
+          exit 1
+        fi
+        if [[ "$_ENV" = '' ]]; then
+          echo >&2 "missing _ENV; use --substitutions on command line"
+          exit 1
+        fi
+        tag=$(date +%Y%m%dt%H%M%S)-$SHORT_SHA
+        image=gcr.io/$PROJECT_ID/vuln-worker:$tag
+        echo "image is $image"
+        # Save image tag for later steps.
+        echo $image > /workspace/image.txt
+
+  - id: Build
+    name: gcr.io/cloud-builders/docker
+    entrypoint: bash
+    args:
+      - -ec
+      - |
+        image=$(cat /workspace/image.txt)
+        docker build -t $image --build-arg DOCKER_IMAGE=$image -f cmd/worker/Dockerfile .
+        docker push $image
+
+  - id: Deploy
+    name: gcr.io/cloud-builders/gcloud
+    entrypoint: bash
+    args:
+      - -ec
+      - |
+        image=$(cat /workspace/image.txt)
+        service=${_ENV}-vuln-worker
+        args="--project $PROJECT_ID --region us-central1"
+        gcloud run deploy $args  $service --image $image
+        # If there was a rollback, `gcloud run deploy` will create a revision but
+        # not point traffic to it. The following command ensures that the new revision
+        # will get traffic.
+        latestTraffic=$(gcloud run services $args describe $service \
+                        --format='value(status.traffic.latestRevision)')
+        if [[ $latestTraffic != True ]]; then
+          gcloud run services $args update-traffic $service --to-latest
+        fi
diff --git a/devtools/deploy_worker.sh b/devtools/deploy_worker.sh
index 7c02741..f431b02 100755
--- a/devtools/deploy_worker.sh
+++ b/devtools/deploy_worker.sh
@@ -4,7 +4,7 @@
 # Use of this source code is governed by a BSD-style
 # license that can be found in the LICENSE file.
 
-# Deploy the vuln worker to Cloud Run.
+# Deploy the vuln worker to Cloud Run, using Cloud Build.
 
 set -e
 
@@ -15,16 +15,6 @@
   [[ $(git status --porcelain) == '' ]]
 }
 
-docker_image_tag() {
-  local timestamp=$(date +%Y%m%dt%H%M%S)
-  local commit=$(git rev-parse --short HEAD)
-  local unclean
-  if ! clean_workspace; then
-    unclean="-unclean"
-  fi
-  echo ${timestamp}-${commit}${unclean}
-}
-
 main() {
   local prefix=
   if [[ $1 = '-n' ]]; then
@@ -41,19 +31,16 @@
   esac
 
   local project=$(tfvar ${env}_project)
-  local image=gcr.io/$project/vuln-worker:$(docker_image_tag)
-
-  $prefix docker build -t $image --build-arg DOCKER_IMAGE=$image -f cmd/worker/Dockerfile .
-  $prefix docker push $image
-  $prefix gcloud run deploy --quiet --project $project $env-vuln-worker --image $image
-  # If there was a rollback, `gcloud run deploy` will create a revision but
-  # not point traffic to it. The following command ensures that the new revision
-  # will get traffic.
-  latestTraffic=$(gcloud run services --project $project describe $env-vuln-worker \
-                  --format='value(status.traffic.latestRevision)')
-  if [[ $latestTraffic != True ]]; then
-    $prefix gcloud run services --project $project update-traffic $env-vuln-worker --to-latest
+  local commit=$(git rev-parse --short HEAD)
+  local unclean
+  if ! clean_workspace; then
+    unclean="-unclean"
   fi
+
+  $prefix gcloud builds submit \
+    --project $project \
+    --config deploy/worker.yaml \
+    --substitutions SHORT_SHA=${commit}${unclean},_ENV=$env
 }
 
 main $@