diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7c8a1fbb..894d1f3f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -28,12 +28,21 @@ jobs:
         secrets: |
           secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials username | PUBLIC_REGISTRY_USERNAME ;
           secret/data/github/repo/${{ github.repository }}/dockerhub/${{ github.repository_owner }}/credentials password | PUBLIC_REGISTRY_PASSWORD ;
-    - name: Login to DockerHub
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
+          secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD ;
+    - name: Login to Public Registry
       uses: docker/login-action@v3
       with:
         registry: ${{ vars.PUBLIC_REGISTRY }}
         username: ${{ env.PUBLIC_REGISTRY_USERNAME }}
         password: ${{ env.PUBLIC_REGISTRY_PASSWORD }}
+    - name: Login to Prime Registry
+      uses: docker/login-action@v3
+      with:
+        registry: ${{ env.PRIME_REGISTRY }}
+        username: ${{ env.PRIME_REGISTRY_USERNAME }}
+        password: ${{ env.PRIME_REGISTRY_PASSWORD }}
     - name: Setup QEMU
       uses: docker/setup-qemu-action@v3
     - name: Setup Docker Buildx
@@ -43,7 +52,7 @@ jobs:
       with:
         fetch-depth: 0
         ref: ${{ github.ref_name}}
-    - name: Build and push all image variations
+    - name: Build and push all image variations to Public Registry
       run: |
         make image-push
         TAG="${TAG}-amd64" TARGET_PLATFORMS=linux/amd64 make image-push
@@ -51,6 +60,14 @@ jobs:
       env:
         TAG: ${{ github.ref_name }}
         REPO: ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_REGISTRY_REPO }}
+    - name: Build and push all image variations to Prime Registry
+      run: |
+        make image-push
+        TAG="${TAG}-amd64" TARGET_PLATFORMS=linux/amd64 make image-push
+        TAG="${TAG}-arm64" TARGET_PLATFORMS=linux/arm64 make image-push
+      env:
+        TAG: ${{ github.ref_name }}
+        REPO: ${{ env.PRIME_REGISTRY }}/${{ vars.PUBLIC_REGISTRY_REPO }}
     - name: Create release
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # required for creating GH release
diff --git a/Makefile b/Makefile
index c1415552..adcb0e6d 100644
--- a/Makefile
+++ b/Makefile
@@ -12,8 +12,14 @@ CRD_CHART?=$(shell find $(ROOT_DIR) -type f -name "rancher-aks-operator-crd*.tgz
 CHART_VERSION?=900 # Only used in e2e to avoid downgrades from rancher
 REPO?=docker.io/rancher/aks-operator
 IMAGE = $(REPO):$(TAG)
-TARGET_PLATFORMS := linux/amd64,linux/arm64
 MACHINE := rancher
+# Define the target platforms that can be used across the ecosystem.
+# Note that what would actually be used for a given project will be
+# defined in TARGET_PLATFORMS, and must be a subset of the below:
+DEFAULT_PLATFORMS := linux/amd64,linux/arm64,darwin/arm64,darwin/amd64
+TARGET_PLATFORMS := linux/amd64,linux/arm64
+BUILDX_ARGS ?= --sbom=true --attest type=provenance,mode=max
+
 CLUSTER_NAME?="aks-operator-e2e"
 E2E_CONF_FILE ?= $(ROOT_DIR)/test/e2e/config/config.yaml
 
@@ -125,9 +131,10 @@ charts:
 	$(MAKE) operator-chart
 	$(MAKE) crd-chart
 
-buildx-machine:
+.PHONY: buildx-machine
+buildx-machine: ## create rancher dockerbuildx machine targeting platform defined by DEFAULT_PLATFORMS
 	@docker buildx ls | grep $(MACHINE) || \
-		docker buildx create --name=$(MACHINE) --platform=$(TARGET_PLATFORMS)
+		docker buildx create --name=$(MACHINE) --platform=$(DEFAULT_PLATFORMS)
 
 .PHONY: image-build
 image-build: buildx-machine ## build (and load) the container image targeting the current platform.
@@ -139,7 +146,7 @@ image-build: buildx-machine ## build (and load) the container image targeting th
 .PHONY: image-push
 image-push: buildx-machine ## build the container image targeting all platforms defined by TARGET_PLATFORMS and push to a registry.
 	docker buildx build -f package/Dockerfile \
-    --builder $(MACHINE) --build-arg VERSION=$(TAG) \
+    --builder $(MACHINE) $(BUILDX_ARGS) --build-arg VERSION=$(TAG) \
     --platform=$(TARGET_PLATFORMS) -t "$(IMAGE)" --push .
 	@echo "Pushed $(IMAGE)"