diff --git a/.gitignore b/.gitignore
index 65f2d27..93d1e78 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,7 @@
+.env
+.env.just
+local.just
+
 *.sfc
 appsettings.Development.json
 kube/
diff --git a/ALttPRandomizer/Program.cs b/ALttPRandomizer/Program.cs
index 31d4548..7377afa 100644
--- a/ALttPRandomizer/Program.cs
+++ b/ALttPRandomizer/Program.cs
@@ -6,6 +6,7 @@
     using ALttPRandomizer.Randomizers;
     using ALttPRandomizer.Service;
     using ALttPRandomizer.Settings;
+    using global::Azure.Core;
     using global::Azure.Identity;
     using global::Azure.Storage.Blobs;
     using Microsoft.AspNetCore.Builder;
@@ -14,12 +15,13 @@
     using Microsoft.Extensions.Logging;
     using Microsoft.Extensions.Options;
     using Serilog;
+    using System;
+    using System.Linq;
     using System.Text.Json;
     using YamlDotNet.Serialization;
     using YamlDotNet.Serialization.NamingConventions;
 
-    internal class Program
-    {
+    internal class Program {
         static void Main(string[] args)
         {
             var builder = WebApplication.CreateBuilder(args);
@@ -44,9 +46,15 @@
             var settings = provider.GetRequiredService<IOptionsMonitor<ServiceOptions>>().CurrentValue!;
             var logger = provider.GetRequiredService<ILogger<Program>>();
 
+            var allowedCors = settings.AllowedCors;
+            var envCors = Environment.GetEnvironmentVariable("ALLOWED_CORS");
+            if (envCors != null) {
+                allowedCors = allowedCors.Concat(envCors.Split()).ToList();
+            }
+
             builder.Services.AddCors(options => {
                 options.AddPolicy("AllowDomains", policy => {
-                    policy.WithOrigins(settings.AllowedCors.ToArray()).AllowAnyMethod().AllowAnyHeader();
+                    policy.WithOrigins(allowedCors.ToArray()).AllowAnyMethod().AllowAnyHeader();
                 });
             });
 
@@ -75,13 +83,22 @@
                 options.OperationFilter<DefaultMysterySettingsFilter>();
             });
 
-            var options = new DefaultAzureCredentialOptions();
-            
-            if (settings.AzureSettings.ClientId != null) {
-                options.ManagedIdentityClientId = new(settings.AzureSettings.ClientId);
+            TokenCredential? token = null;
+
+            if (Environment.GetEnvironmentVariable("USE_SAMI") == "true") {
+                token = new ManagedIdentityCredential(ManagedIdentityId.SystemAssigned);
+            } else {
+                var options = new DefaultAzureCredentialOptions();
+
+                var clientId = Environment.GetEnvironmentVariable("CLIENT_ID");
+
+                if (clientId != null) {
+                    options.ManagedIdentityClientId = new(clientId);
+                }
+
+                token = new DefaultAzureCredential(options);
             }
 
-            var token = new DefaultAzureCredential(options);
             var seedClient = new BlobContainerClient(settings.AzureSettings.BlobstoreEndpoint, token);
 
             builder.Services.AddSingleton(seedClient);
diff --git a/ALttPRandomizer/SeedController.cs b/ALttPRandomizer/SeedController.cs
index 8cbb11e..c6a54e3 100644
--- a/ALttPRandomizer/SeedController.cs
+++ b/ALttPRandomizer/SeedController.cs
@@ -111,6 +111,12 @@
             }
         }
 
+        [Route("/healthcheck")]
+        [HttpGet]
+        public StatusCodeResult GetHealthCheck() {
+            return Ok();
+        }
+
         private ObjectResult ResolveResult(IDictionary<string, object> result) {
             if (result.TryGetValue("status", out var responseCode)) {
                 if (responseCode is int code) {
diff --git a/ALttPRandomizer/appsettings.Docker.json b/ALttPRandomizer/appsettings.Docker.json
index af795ac..0367e27 100644
--- a/ALttPRandomizer/appsettings.Docker.json
+++ b/ALttPRandomizer/appsettings.Docker.json
@@ -5,10 +5,9 @@
     "allowedCors": [
       "https://new.alttpr.gwaa.kiwi",
       "https://api.alttpr.gwaa.kiwi",
-      "http://localhost:8082"
+      "http://localhost:8082",
     ],
     "azureSettings": {
-      "clientId": "a48d5ae1-fa0a-4e33-9586-18c0eca0a28c",
       "blobstoreEndpoint": "https://alttprstorage.blob.core.windows.net/seeds"
     },
     "generators": {
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..d91ce03
--- /dev/null
+++ b/justfile
@@ -0,0 +1,25 @@
+set dotenv-filename := ".env.just"
+
+import? "local.just"
+
+[private]
+@list:
+  just --list --list-submodules --unsorted
+
+# Build docker image
+[group("docker")]
+[arg("TAG", long="tag", short="t")]
+build VERSION="latest" TAG=env("DOCKER_TAG"):
+  DOCKER_BUILDKIT=1 docker build . --progress=plain -t {{TAG}}:{{VERSION}}
+
+# Run docker image
+[group("docker")]
+[arg("TAG", long="tag", short="t")]
+run VERSION="latest" TAG=env("DOCKER_TAG"): (build VERSION TAG)
+  docker run -p 5000:8080 {{TAG}}:{{VERSION}}
+
+# Push docker image to registry
+[group("docker")]
+[arg("TAG", long="tag", short="t")]
+push VERSION="latest" TAG=env("DOCKER_TAG"): (build VERSION TAG)
+  docker push {{TAG}}:{{VERSION}}