diff --git a/dev/ci/internal/ci/images_operations.go b/dev/ci/internal/ci/images_operations.go
index b6069430ffd..f1ddf3dbe41 100644
--- a/dev/ci/internal/ci/images_operations.go
+++ b/dev/ci/internal/ci/images_operations.go
@@ -118,6 +118,8 @@ func bazelPushImagesCmd(c Config, isCandidate bool, opts ...bk.StepOpt) func(*bk
 		}
 	}
 
+	_, bazelRC := aspectBazelRC()
+
 	return func(pipeline *bk.Pipeline) {
 		pipeline.AddStep(stepName,
 			append(opts,
@@ -129,6 +131,7 @@ func bazelPushImagesCmd(c Config, isCandidate bool, opts ...bk.StepOpt) func(*bk
 				bk.Env("DEV_REGISTRY", devRegistry),
 				bk.Env("PROD_REGISTRY", prodRegistry),
 				bk.Env("ADDITIONAL_PROD_REGISTRIES", additionalProdRegistry),
+				bk.Cmd(bazelStampedCmd(fmt.Sprintf(`build $$(bazel --bazelrc=%s --bazelrc=.aspect/bazelrc/ci.sourcegraph.bazelrc query 'kind("oci_push rule", //...)')`, bazelRC))),
 				bk.ArtifactPaths("build_event_log.bin"),
 				bk.AnnotatedCmd(
 					"./dev/ci/push_all.sh",
diff --git a/dev/ci/push_all.sh b/dev/ci/push_all.sh
index dff5516328a..79022130db5 100755
--- a/dev/ci/push_all.sh
+++ b/dev/ci/push_all.sh
@@ -57,20 +57,14 @@ function create_push_command() {
   fi
 
   for registry in "${registries[@]}"; do
-    # This biblical bash string replaces running `bazel run` on each oci_push target, to avoid the (temporary) bazel server lock
-    # that is unnecessary for us due to building all the targets beforehand, allowing the maximum possible concurrency. It is similar
-    # to the script that is emitted by `bazel run --run_script=out.sh <target>`, but without the need to wait for the server to be unlocked
-    # in the same way as just running `bazel run`.
-    # It makes the following assumptions:
-    # - the executable script for the oci_push target is named push_<target name>.sh
-    # - the target is built and exists in the bazel bindir (we do this with a bazel build below)
-    # - runfiles are always adajcent to the executable script
+    cmd="bazel \
+      ${bazelrc[*]} \
+      run \
+      $target \
+      --stamp \
+      --workspace_status_command=./dev/bazel_stamp_vars.sh"
 
-    # echo to /dev/null is for the final output in Buildkite
-    echo "echo $target >/dev/null && \
-      pushd $(realpath bazel-bin)$(echo "${target}.sh.runfiles/__main__" | sed 's/:/\/push_/') && \
-      $(realpath bazel-bin)$(echo "${target}.sh" | sed 's/:/\/push_/') $tags_args --repository ${registry}/${repository} && \
-      popd && $(echo_append_annotation "$repository" "$registry" "${tags_args[@]}")"
+    echo "$cmd -- $tags_args --repository ${registry}/${repository} && $(echo_append_annotation "$repository" "$registry" "${tags_args[@]}")"
   done
 }
 
@@ -176,13 +170,6 @@ honeyvent=$(bazel "${bazelrc[@]}" build //dev/tools:honeyvent 2>/dev/null && baz
 
 images=$(bazel "${bazelrc[@]}" query 'kind("oci_push rule", //...)')
 
-echo "--- :bazel: Building all oci_push targets"
-
-# shellcheck disable=SC2086
-bazel "${bazelrc[@]}" build --stamp --workspace_status_command=./dev/bazel_stamp_vars.sh ${images}
-
-echo "--- :bash: Generating jobfile - started"
-
 job_file=$(mktemp)
 # shellcheck disable=SC2064
 trap "rm -rf $job_file" EXIT
@@ -199,7 +186,7 @@ for target in ${images[@]}; do
   fi
 done
 
-echo "--- :bash: Generating jobfile - done"
+echo "--- :bash: Generated jobfile"
 cat "$job_file"
 
 echo "--- :bazel::docker: Pushing images..."