diff --git a/services/web/bin/push-translations-changes.sh b/services/web/bin/push-translations-changes.sh
index 6e0df59cd3..0f5b8274f8 100755
--- a/services/web/bin/push-translations-changes.sh
+++ b/services/web/bin/push-translations-changes.sh
@@ -1,14 +1,18 @@
 #!/bin/bash
 set -e
 
-if [[ -z "$BRANCH_NAME" ]]; then
-  BRANCH_NAME=master
-fi
+SCRIPT_PATH=$(realpath "${BASH_SOURCE[0]}")
+SCRIPT_DIR=$(dirname "$SCRIPT_PATH")
+WEB_DIR=$(dirname "$SCRIPT_DIR")
+
+cd "$WEB_DIR"
 
 if [[ `git status --porcelain=2 locales/` ]]; then
   git add locales/*
   git commit -m "auto update translation"
-  git push "$UPSTREAM_REPO" "HEAD:$BRANCH_NAME"
+  # Switch the cloudbuild clone from https to ssh authentication.
+  git remote set-url --push origin git@github.com:overleaf/internal.git
+  git push origin "HEAD:$BRANCH_NAME"
 else
   echo 'No changes'
 fi
diff --git a/services/web/scripts/translations/.dockerignore b/services/web/scripts/translations/.dockerignore
new file mode 100644
index 0000000000..b1b3061733
--- /dev/null
+++ b/services/web/scripts/translations/.dockerignore
@@ -0,0 +1,6 @@
+node_modules/
+
+# Limit code access with minimal docker image.
+cloudbuild.yaml
+docker-compose.yml
+Dockerfile
diff --git a/services/web/scripts/translations/Dockerfile b/services/web/scripts/translations/Dockerfile
new file mode 100644
index 0000000000..38a114c5aa
--- /dev/null
+++ b/services/web/scripts/translations/Dockerfile
@@ -0,0 +1,7 @@
+FROM node:12.22.3
+
+WORKDIR /app/scripts/translations
+
+COPY . /app/scripts/translations/
+
+RUN npm ci --quiet
diff --git a/services/web/scripts/translations/docker-compose.yml b/services/web/scripts/translations/docker-compose.yml
new file mode 100644
index 0000000000..c098a82b21
--- /dev/null
+++ b/services/web/scripts/translations/docker-compose.yml
@@ -0,0 +1,12 @@
+version: "2.3"
+
+services:
+  onesky-client-jail:
+    build: .
+    volumes:
+      # NOTE: Limit code access with targeted bind mount:
+      # Give it read-and-write access to the locales.
+      - ../../locales:/app/locales:rw
+    environment:
+      - ONE_SKY_PUBLIC_KEY
+      - ONE_SKY_PRIVATE_KEY