diff --git a/cmd/api/main.go b/cmd/api/main.go
index 015b06f..7c1c513 100644
--- a/cmd/api/main.go
+++ b/cmd/api/main.go
@@ -244,7 +244,7 @@ func (s *server) prepareWorkspace(tok string) (string, string, error) {
 	}
 	os.Setenv("HOME", home)
 
-	// Write Docker config.
+	// Write Docker config with user credentials.
 	auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("oauth2accesstoken:%s", tok)))
 	configJSON := fmt.Sprintf(`{
 	"auths": {
@@ -279,7 +279,6 @@ func (s *server) fetchAndBuild(src, layers, tok string, req *gcb.Build) error {
 		fmt.Sprintf("chown -R %d:%d %s", os.Geteuid(), os.Getgid(), src),
 		fmt.Sprintf("chown -R %d:%d %s", os.Geteuid(), os.Getgid(), layers),
 		fmt.Sprintf("wget -qO- %s | tar xz -C %s", source, src),
-		fmt.Sprintf("cat $HOME/.docker/config.json"),
 		fmt.Sprintf("/lifecycle/detector -app=%s -group=%s/group.toml -plan=%s/plan.toml", src, layers, layers),
 		fmt.Sprintf("/lifecycle/analyzer -layers=%s -helpers=false -group=%s/group.toml %s", layers, layers, image),
 		fmt.Sprintf("/lifecycle/builder -layers=%s -app=%s -group=%s/group.toml -plan=%s/plan.toml", layers, src, layers, layers),
@@ -293,7 +292,7 @@ func (s *server) fetchAndBuild(src, layers, tok string, req *gcb.Build) error {
 }
 
 func (s *server) getImage(image string) (v1.Image, error) {
-	ref, err := name.NewTag(image, name.WeakValidation)
+	ref, err := name.NewTag(image)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/buildpack/main.go b/cmd/buildpack/main.go
index fed13b6..78b9eb7 100644
--- a/cmd/buildpack/main.go
+++ b/cmd/buildpack/main.go
@@ -3,7 +3,6 @@ package main
 import (
 	"bytes"
 	"context"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -24,7 +23,6 @@ import (
 	"github.com/google/go-containerregistry/pkg/v1/types"
 	"github.com/imjasonh/kontain.me/pkg/run"
 	"github.com/imjasonh/kontain.me/pkg/serve"
-	"golang.org/x/oauth2/google"
 )
 
 var projectID = ""
@@ -211,23 +209,6 @@ func (s *server) resolveCommit(repo, ref string) (string, error) {
 }
 
 func (s *server) prepareWorkspace() (string, string, error) {
-	// Write Docker config.
-	tok, err := google.ComputeTokenSource("").Token()
-	if err != nil {
-		return "", "", fmt.Errorf("getting access token from metadata: %v", err)
-	}
-	auth := base64.StdEncoding.EncodeToString([]byte(fmt.Sprintf("oauth2accesstoken:%s", tok.AccessToken)))
-	configJSON := fmt.Sprintf(`{
-	"auths": {
-		"https://gcr.io": {
-			"auth": %q
-		}
-	}
-}`, auth)
-	if err := run.Do(s.info.Writer(), "mkdir -p ~/.docker/ && cat << EOF > ~/.docker/config.json\n"+string(configJSON)+"\nEOF"); err != nil {
-		return "", "", err
-	}
-
 	// Create tempdir to store app source.
 	src, err := ioutil.TempDir("", "")
 	if err != nil {
@@ -240,7 +221,7 @@ func (s *server) prepareWorkspace() (string, string, error) {
 		return "", "", err
 	}
 
-	// Create and set $HOME.
+	// Create and set $HOME, which is otherwise not writable.
 	home, err := ioutil.TempDir("", "")
 	if err != nil {
 		return "", "", err