diff --git a/.github/workflows/publish-env-def.yml b/.github/workflows/publish-env-def.yml
new file mode 100644
index 000000000..b8dfb3d16
--- /dev/null
+++ b/.github/workflows/publish-env-def.yml
@@ -0,0 +1,37 @@
+name: Publish environment definition to registry
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "spin-up.(ver).toml version, e.g. 3.4, 3.5"
+        required: true
+        type: string
+
+jobs:
+  publish-env-def:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      packages: write
+      contents: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+
+      - name: Install oras
+        uses: oras-project/setup-oras@v1
+
+      - name: Login to the GitHub registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: spinframeworkbot
+          password: ${{ secrets.SPIN_WIT_PAT }}
+
+      - name: Publish environment TOML
+        shell: bash
+        env:
+          VERSION: ${{ inputs.version }}
+        run: ./scripts/push-env-def.sh
diff --git a/scripts/push-env-def.sh b/scripts/push-env-def.sh
new file mode 100755
index 000000000..779f32f3c
--- /dev/null
+++ b/scripts/push-env-def.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail 
+
+oras push ghcr.io/spinframework/environments/spin-up:$VERSION target-envs/spin-up.$VERSION.toml
diff --git a/target-envs/README.md b/target-envs/README.md
new file mode 100644
index 000000000..7c16aeb02
--- /dev/null
+++ b/target-envs/README.md
@@ -0,0 +1,14 @@
+# Spin target environments
+
+This folder contains target environment definitions for Spin. Each target
+environment is a TOML file which maps triggers to the WIT worlds supported by
+those triggers. When pushed to an OCI registry, these can be referenced
+in the Spin manifest `application.targets` array.
+
+Pushed environment definitions should not include the `.toml` extension
+and should be versioned using OCI versioning, e.g. `spin-up:3.4`
+We avoid using this convention for the source files because 1. syntax
+highlighting and 2. Windows filenames.
+
+Versions should include _minor version only_ because WITs should not
+change in patch releases.
diff --git a/target-envs/spin-up.3.2.toml b/target-envs/spin-up.3.2.toml
new file mode 100644
index 000000000..ea5dd4437
--- /dev/null
+++ b/target-envs/spin-up.3.2.toml
@@ -0,0 +1,7 @@
+default = { worlds = ["spin:up/platform@3.2.0"] }
+
+[triggers]
+
+[triggers.http]
+worlds = ["spin:up/http-trigger@3.2.0"]
+capabilities = ["local_service_chaining"]
diff --git a/target-envs/spin-up.3.4.toml b/target-envs/spin-up.3.4.toml
new file mode 100644
index 000000000..8b564e2a0
--- /dev/null
+++ b/target-envs/spin-up.3.4.toml
@@ -0,0 +1,7 @@
+default = { worlds = ["spin:up/platform@3.4.0"] }
+
+[triggers]
+
+[triggers.http]
+worlds = ["spin:up/http-trigger@3.4.0"]
+capabilities = ["local_service_chaining"]
diff --git a/target-envs/spin-up.3.5.toml b/target-envs/spin-up.3.5.toml
new file mode 100644
index 000000000..9e85905c1
--- /dev/null
+++ b/target-envs/spin-up.3.5.toml
@@ -0,0 +1,7 @@
+default = { worlds = ["spin:up/platform@3.5.0"] }
+
+[triggers]
+
+[triggers.http]
+worlds = ["spin:up/http-trigger@3.5.0", "spin:up/http-trigger@3.4.0"]
+capabilities = ["local_service_chaining"]