diff --git a/Jenkinsfile b/Jenkinsfile
index 004c88b013..1752a79a47 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -1,18 +1,47 @@
+/* Expected Parameters
+  JENKINS_VERSION: the Jenkins version to release
+  JENKINS_SHA: the sha1
+  INTERNAL: if true, push to an internal docker registry instead of public
+*/
 node('dockerhub') {
+  def internal = (INTERNAL == 'true')
+  def dockerRegistry, dockerCredentials, warUrl
+  if (internal) {
+    dockerRegistry = 'https://docker.cloudbees.com'
+    dockerCredentials = 'docker.cloudbees.com'
+    withCredentials([[$class: 'UsernamePasswordMultiBinding', credentialsId: 'nexus-internal', usernameVariable: 'NEXUS_USERNAME', passwordVariable: 'NEXUS_PASSWORD']]) {
+      warUrl = "-u ${env.NEXUS_USERNAME}:${env.NEXUS_PASSWORD} https://nexus-internal.cloudbees.com/content/groups/mct/com/cloudbees/jenkins/main/jenkins-enterprise-war/${JENKINS_VERSION}/jenkins-enterprise-war-${JENKINS_VERSION}.war"
+    }
+  } else {
+    dockerRegistry = ''
+    dockerCredentials = 'dockerhub'
+    warUrl = "http://jenkins-updates.cloudbees.com/download/je/${JENKINS_VERSION}/jenkins.war"
+  }
   def repo = "cloudbees/jenkins-enterprise"
+  def dockerTag = "${repo}:${JENKINS_VERSION}"
   def branch = "cje"
 
   stage 'Build'
   git url: 'https://github.com/cloudbees/docker.git', branch: branch
-  sh "docker build --pull --no-cache --build-arg JENKINS_VERSION=${JENKINS_VERSION} --build-arg JENKINS_SHA=${JENKINS_SHA} -t ${repo}:${JENKINS_VERSION} ."
-  // need --build-arg support
-  //def img = docker.build("${repo}:${JENKINS_VERSION}")
-  def img = docker.image("${repo}:${JENKINS_VERSION}")
-  img.tag("latest")
+  sh """
+    set +x
+    docker build --pull \
+                 --no-cache \
+                 --build-arg "JENKINS_VERSION=${JENKINS_VERSION}" \
+                 --build-arg "JENKINS_SHA=${JENKINS_SHA}" \
+                 --build-arg "WAR_URL=${warUrl}" \
+                  -t $dockerTag .
+  """
+  def img = docker.image(dockerTag)
+  if (!internal) {
+    img.tag("latest")
+  }
 
   stage 'Push'
-  docker.withRegistry('', 'dockerhub') {
+  docker.withRegistry(dockerRegistry, dockerCredentials) {
     img.push();
-    img.push('latest');
+    if (!internal) {
+      img.push('latest');
+    }
   }
 }