diff --git a/.gitea/workflows/build-dev.yml b/.gitea/workflows/build-dev.yml
index c151367..959261c 100644
--- a/.gitea/workflows/build-dev.yml
+++ b/.gitea/workflows/build-dev.yml
@@ -6,35 +6,35 @@ jobs:
   update-and-build:
     runs-on: radiantwave-actions
     steps:
-      - name: Print Environment
-        run: |
-          echo "=== whoami/hostname ==="
-          whoami
-          hostname
-          echo "=== pwd ==="
-          pwd
-          echo "=== PATH ==="
-          echo "$PATH"
-          echo "=== full env ==="
-          env | sort
-          echo "=== os-release ==="
-          cat /etc/os-release 2>/dev/null || echo "no os-release"
-          echo "=== does /nix exist ==="
-          ls -la /nix 2>&1 || echo "/nix missing"
-          echo "=== does /nix/var/nix/profiles/default/bin exist ==="
-          ls -la /nix/var/nix/profiles/default/bin 2>&1 || echo "missing"
-          echo "=== is this a container ==="
-          cat /proc/1/cgroup 2>/dev/null | head -5
-          [ -f /.dockerenv ] && echo "IS a docker container" || echo "NOT a docker container (no /.dockerenv)"
+      # - name: Print Environment
+      #   run: |
+      #     echo "=== whoami/hostname ==="
+      #     whoami
+      #     hostname
+      #     echo "=== pwd ==="
+      #     pwd
+      #     echo "=== PATH ==="
+      #     echo "$PATH"
+      #     echo "=== full env ==="
+      #     env | sort
+      #     echo "=== os-release ==="
+      #     cat /etc/os-release 2>/dev/null || echo "no os-release"
+      #     echo "=== does /nix exist ==="
+      #     ls -la /nix 2>&1 || echo "/nix missing"
+      #     echo "=== does /nix/var/nix/profiles/default/bin exist ==="
+      #     ls -la /nix/var/nix/profiles/default/bin 2>&1 || echo "missing"
+      #     echo "=== is this a container ==="
+      #     cat /proc/1/cgroup 2>/dev/null | head -5
+      #     [ -f /.dockerenv ] && echo "IS a docker container" || echo "NOT a docker container (no /.dockerenv)"
 
       - name: Checkout
         uses: actions/checkout@v6
 
-      - name: Install Nix
-        uses: cachix/install-nix-action@v31
-        with:
-          extra_nix_config: |
-            experimental-features = nix-command flakes
+      # - name: Install Nix
+      #   uses: cachix/install-nix-action@v31
+      #   with:
+      #     extra_nix_config: |
+      #       experimental-features = nix-command flakes
 
       - name: Configure git auth for Gitea
         run: |
@@ -59,7 +59,7 @@ jobs:
           export NIXPKGS_ALLOW_UNFREE=1
           . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
           nix build -L --impure .#nixosConfigurations.dev-iso.config.system.build.isoImage
-          cp -rL result/iso/*.iso /ssd/radiantwave/build/radiantwave-kiosk-iso-dev-$(date +%Y-%m-%d_%H-%M-%S).iso
+          cp -rL result/iso/*.iso /home/runner/radiantwave/radiantwave-kiosk-iso-dev-$(date +%Y-%m-%d_%H-%M-%S).iso
 
       - name: Commit updated flake.lock
         run: |
@@ -71,7 +71,7 @@ jobs:
           git push
 
       - name: Copy ISO to fileserver
-        run: scp result/iso/* radiantwave-infra:/mnt/infrastructure_data/files/images/
+        run: scp /home/runner/radiantwave/iso/* radiantwave-infra:/mnt/infrastructure_data/files/images/
 
       - name: Notify
         if: always()
diff --git a/.gitea/workflows/build-prod.yml b/.gitea/workflows/build-prod.yml
new file mode 100644
index 0000000..eb83ce3
--- /dev/null
+++ b/.gitea/workflows/build-prod.yml
@@ -0,0 +1,77 @@
+on:
+  push:
+    branches:
+      - main
+jobs:
+  update-and-build:
+    runs-on: radiantwave-actions
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Configure git auth for Gitea
+        run: |
+          git config --global url."https://oauth2:${{ secrets.GIT_TOKEN }}@gitea.radiantwavetech.com/".insteadOf "https://gitea.radiantwavetech.com/"
+
+      - name: Update radiantwave
+        run: |
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix flake update radiantwave
+
+        # This builds the system closure
+        # these builds just verify all closures compile successfully before creating ISO images
+        # or allowing updates.
+      - name: Build dev VM
+        run: |
+          export NIXPKGS_ALLOW_UNFREE=1
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix build -L --impure .#nixosConfigurations.radiantwavekiosk.config.system.build.toplevel
+          nix build -L --import .#nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel
+          nix build -L --import .#nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel
+
+        # If the closure builds, it's valid, even if incorrect and something is wrong.
+        # That's why we build the ISO next, even for the dev branch, for testing
+      - name: Build dev ISO
+        run: |
+          export NIXPKGS_ALLOW_UNFREE=1
+          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
+          nix build -L --impure .#nixosConfigurations.radiantwavekiosk.config.system.build.toplevel
+          cp -rL result/iso/*.iso /home/runner/radiantwave/radiantwave-kiosk-iso-$(date +%Y-%m-%d_%H-%M-%S).iso
+
+          nix build -L --impure .#nixosConfigurations.radiantwavekiosk-android.config.system.build.toplevel
+          cp -rL result/iso/*.iso /home/runner/radiantwave/radiantwave-kiosk-android-iso-$(date +%Y-%m-%d_%H-%M-%S).iso
+
+          nix build -L --impure .#nixosConfigurations.radiantwavekiosk-commercial.config.system.build.toplevel
+          cp -rL result/iso/*.iso /home/runner/radiantwave/radiantwave-kiosk-commercial-iso-$(date +%Y-%m-%d_%H-%M-%S).iso
+
+          nix build -L --impure .#nixosConfigurations.radiantwavekiosk-rpi.config.system.build.sdImage
+          cp -rL result/images/*.zst /home/runner/radiantwave/radiantwave-kiosk-rpi-($date +%Y-%m-%d_%H-%M-%S).img.zst
+
+      - name: Copy outputs to fileserver
+        run: |
+          scp /home/runner/radiantwave/* nclack@157.245.124.103:/mnt/infrastructure_data/files/images/
+
+      - name: Commit updated flake.lock
+        run: |
+          git config user.email "ci@radiantwavetech.com"
+          git config user.name "RadiantWave CI"
+          git remote set-url origin https://oauth2:${{ secrets.GIT_TOKEN }}@gitea.radiantwavetech.com/RadiantWaveTech/KioskConfig.git
+          git add flake.lock
+          git commit -m "chore: update radiantwave-dev to latest dev" || echo "Nothing to commit"
+          git push
+
+      - name: Copy ISO to fileserver
+        run: scp result/iso/* radiantwave-infra:/mnt/infrastructure_data/files/images/
+
+      - name: Notify
+        if: always()
+        uses: https://github.com/dawidd6/action-send-mail@v3
+        with:
+          server_address: smtp.gmail.com
+          server_port: 465
+          username: ${{ secrets.MAIL_USERNAME }}
+          password: ${{ secrets.MAIL_PASSWORD }}
+          subject: "${{ job.status == 'success' && '✅' || '❌' }} KioskConfig dev build ${{ job.status }}"
+          to: nclack@radiantwavetech.com
+          from: ci@radiantwavetech.com
+          body: "KioskConfig dev build ${{ job.status }} — radiantwave-dev updated and arstifacts copied to /ssd/radiantwave/build/"