diff --git a/.circleci/config.yml b/.circleci/config.yml
new file mode 100644
index 00000000..1aa5bc92
--- /dev/null
+++ b/.circleci/config.yml
@@ -0,0 +1,42 @@
+version: 2
+jobs:
+  build:
+    docker:
+      - image: circleci/golang:1.10
+    working_directory: /go/src/github.com/segmentio/aws-okta
+    steps:
+      - checkout
+      - run:
+          name: Build
+          command: |
+            make govendor dist
+      - persist_to_workspace:
+          root: .
+          paths: ['dist/*']
+
+  release:
+    docker:
+      - image: circleci/golang:1.10
+    working_directory: /go/src/github.com/segmentio/aws-okta
+    steps:
+      - checkout
+      - attach_workspace: { at: . }
+      - run:
+          name: Release
+          # TODO: cache from build step
+          command: |
+            make release
+
+workflows:
+  version: 2
+  test-deploy:
+    jobs:
+      - build
+      - release:
+          requires:
+            - build
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /v[0-9]+(\.[0-9]+)*/
diff --git a/circle.yml b/circle.yml
deleted file mode 100644
index 596f06a0..00000000
--- a/circle.yml
+++ /dev/null
@@ -1,50 +0,0 @@
-machine:
-  pre:
-    - curl -sSL https://s3.amazonaws.com/circle-downloads/install-circleci-docker.sh | bash -s -- 1.10.0
-  services:
-    - docker
-  environment:
-    ECR_ENABLED: TRUE
-
-dependencies:
-  pre:
-    - docker login -e ${DOCKER_EMAIL} -u ${DOCKER_USER} -p ${DOCKER_PASS}
-    - pip install awscli
-    - $(aws ecr get-login --region $AWS_REGION)
-  override:
-    - docker pull $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/golang-private:latest
-
-test:
-  override:
-    - >
-      docker run
-      $(env | grep -E '^CIRCLE_|^DOCKER_|^AWS_|^GH_|^NPM_|^PRODUCTION_|^STAGE_|^CIRCLECI=|^CI=' | sed 's/^/--env /g' | tr "\\n" " ")
-      --rm
-      --tty
-      --interactive
-      --name go
-      --net host
-      --volume /var/run/docker.sock:/run/docker.sock
-      --volume ${GOPATH%%:*}/src:/go/src
-      --volume ${PWD}:/go/src/github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}
-      --workdir /go/src/github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}
-      $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/golang-private:latest
-
-deployment:
-  release:
-    tag: /v[0-9]+(\.[0-9]+)*/
-    commands:
-      - >
-        docker run
-        $(env | grep -E '^CIRCLE_|^DOCKER_|^AWS_|^GH_|^NPM_|^PRODUCTION_|^STAGE_|^CIRCLECI=|^CI=' | sed 's/^/--env /g' | tr "\\n" " ")
-        --rm
-        --tty
-        --interactive
-        --name release
-        --net host
-        --volume /var/run/docker.sock:/run/docker.sock
-        --volume ${GOPATH%%:*}/src:/go/src
-        --volume ${PWD}:/go/src/github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}
-        --workdir /go/src/github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}
-        --entrypoint make
-        $AWS_ACCOUNT_ID.dkr.ecr.$AWS_REGION.amazonaws.com/golang-private:latest release