diff --git a/cfg/jobs/incus_publish.run b/cfg/jobs/incus_publish.run
new file mode 100644
index 0000000..8e4ff3b
--- /dev/null
+++ b/cfg/jobs/incus_publish.run
@@ -0,0 +1,32 @@
+#!/bin/env bash
+set -euxo pipefail
+
+# Clean
+incus exec "$CNAME" -- \
+  rm -rf \
+    /etc/machine-id \
+    /var/cache/apt \
+    /var/log/journal
+
+# Publish
+incus stop "$CNAME"
+incus config metadata show "$CNAME" > "$ARCHIVE"/metadata.yaml
+# Get the current Unix timestamp
+current_timestamp=$(date +%s)
+# Calculate expiry date as current timestamp + 1 week (604800 seconds)
+expiry_date=$((current_timestamp + 604800))
+# Update metadata values
+sed -i \
+  -e "s/creation_date: .*/creation_date: $current_timestamp/" \
+  -e "s/expiry_date: .*/expiry_date: $expiry_date/" \
+  -e "s#description: .*#description: $UPSTREAM_NAME v$UPSTREAM_VER on $IMAGE release $SERIAL#" \
+  -e "s/name: .*/name: $CNAME/" \
+  -e "s/serial: .*/serial: $SERIAL/" \
+  "$ARCHIVE"/metadata.yaml
+
+incus config metadata edit "$CNAME" < "$ARCHIVE"/metadata.yaml
+incus publish "$CNAME" \
+  --alias "$ALIAS" \
+  --public \
+  --quiet
+incus rm "$CNAME"