diff --git a/build/Dockerfile b/build/Dockerfile
index a21fee6..b6a819c 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,4 +1,4 @@
-FROM gcr.io/distroless/static-debian12:latest as production
+FROM scratch
 ARG TARGETARCH
 ARG TARGETOS
 
diff --git a/build/Justfile b/build/Justfile
index 1f93f52..7b2f001 100644
--- a/build/Justfile
+++ b/build/Justfile
@@ -1,20 +1,3 @@
-# Deploy the application to fly.io
-deploy-fly:
-  fly deploy --ha=false -c deploy/fly.toml -i {{DOCKER_IMAGE}}
-
-# Read local jwt key and set it as fly secret
-deploy-fly-set-jwt-key-secrets:
-  #!/bin/bash
-  # https://github.com/superfly/flyctl/issues/589
-  cat <<EOF | fly secrets import -c deploy/fly.toml
-  JWT_PRIVATE_KEY="""{{JWT_PRIVATE_KEY}}"""
-  JWT_PUBLIC_KEY="""{{JWT_PUBLIC_KEY}}"""
-  EOF
-
-# Deploy locally with docker compose
-deploy-docker: build-docker
-  docker compose --file dpeloy/docker-compose.yaml up
-
 # Build the application
 build: build-bin build-docker
 
diff --git a/deploy/Justfile b/deploy/Justfile
new file mode 100644
index 0000000..23a74f3
--- /dev/null
+++ b/deploy/Justfile
@@ -0,0 +1,16 @@
+# Deploy the application to fly.io
+deploy-fly:
+  fly deploy --ha=false -c deploy/fly.toml -i {{DOCKER_IMAGE}}
+
+# Read local jwt key and set it as fly secret
+deploy-fly-set-jwt-key-secrets:
+  #!/bin/bash
+  # https://github.com/superfly/flyctl/issues/589
+  cat <<EOF | fly secrets import -c deploy/fly.toml
+  JWT_PRIVATE_KEY="""{{JWT_PRIVATE_KEY}}"""
+  JWT_PUBLIC_KEY="""{{JWT_PUBLIC_KEY}}"""
+  EOF
+
+# Deploy locally with docker compose
+deploy-docker: build-docker
+  docker compose --file dpeloy/docker-compose.yaml up
diff --git a/justfile b/justfile
index b55e5fe..7304cc5 100644
--- a/justfile
+++ b/justfile
@@ -17,6 +17,7 @@ ARCH := "amd64 arm64"
 
 export CGO_ENABLED := "0"
 import 'build/Justfile'
+import 'deploy/Justfile'
 
 _default:
   @just --list
@@ -86,6 +87,12 @@ migration-new name:
   echo "Created migration file: $FILENAME"
 
 update-dependencies:
+  # Updating temporal dependencies is a bit tricky
+  #  as finding the right combination of api, server and ui-server
+  #  that work together is not easy.
+  # Any version of ui-server > 2.23.0 < 2.27.2 is broken for us.
+  # Using latest of everything results (at the time of writing) in to
+  #  working server but broken ui-server (404 when it tries to list namespaces).
   go get -u -t \
     go.k6.io/k6@v0.51.0 \
     github.com/temporalio/ui-server/v2@v2.23.0 \