diff --git a/.gitea/workflows/build-dev.yml b/.gitea/workflows/build-dev.yml
index 6b8bc7d..80337a3 100644
--- a/.gitea/workflows/build-dev.yml
+++ b/.gitea/workflows/build-dev.yml
@@ -10,14 +10,14 @@ env:
     extra-trusted-public-keys = radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=
 jobs:
   build-dev-kiosk:
-    runs-on: build-server
+    runs-on: orion-lxc
     steps:
       - name: Clone Repository
         run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
       - name: Checkout dev branch
         run: git checkout dev
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
       - name: Build dev kiosk ISO
         run: |
           export NIXPKGS_ALLOW_UNFREE=1
@@ -27,24 +27,24 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-kiosk-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
       - name: Copy dev kiosk ISO to fileserver
         run: |
-          scp "/home/user/radiantwave/${FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
       - name: Cleanup
-        run: rm -f "/home/user/radiantwave/${FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
 
   build-dev-android:
-    runs-on: build-server
+    runs-on: orion-lxc
     steps:
       - name: Clone Repository
         run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
       - name: Checkout dev branch
         run: git checkout dev
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
       - name: Build dev android ISO
         run: |
           export NIXPKGS_ALLOW_UNFREE=1
@@ -54,24 +54,24 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-android-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
       - name: Copy dev android ISO to fileserver
         run: |
-          scp "/home/user/radiantwave/${FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
       - name: Cleanup
-        run: rm -f "/home/user/radiantwave/${FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
 
   build-dev-commercial:
-    runs-on: build-server
+    runs-on: orion-lxc
     steps:
       - name: Clone Repository
         run: git clone --depth 1 --no-single-branch ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
       - name: Checkout dev branch
         run: git checkout dev
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
       - name: Build dev commercial ISO
         run: |
           export NIXPKGS_ALLOW_UNFREE=1
@@ -81,11 +81,11 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-commercial-dev-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "FILENAME=${FILENAME}" >> "$GITHUB_ENV"
       - name: Copy dev commercial ISO to fileserver
         run: |
-          scp "/home/user/radiantwave/${FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
       - name: Cleanup
-        run: rm -f "/home/user/radiantwave/${FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${FILENAME}"
diff --git a/.gitea/workflows/build-prod-android.yml b/.gitea/workflows/build-prod-android.yml
index b17894a..56a83c2 100644
--- a/.gitea/workflows/build-prod-android.yml
+++ b/.gitea/workflows/build-prod-android.yml
@@ -11,7 +11,7 @@ env:
 
 jobs:
   build-android:
-    runs-on: build-server
+    runs-on: orion-lxc
 
     steps:
       - name: Checkout
@@ -29,7 +29,7 @@ jobs:
           fi
 
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
 
       - name: Build android kiosk ISO
         run: |
@@ -41,13 +41,13 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-android-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "ANDROID_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
 
       - name: Copy android kiosk ISO to fileserver
         run: |
-          scp "/home/user/radiantwave/${ANDROID_ISO_FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
 
       - name: Cleanup android kiosk ISO
-        run: rm -f "/home/user/radiantwave/${ANDROID_ISO_FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${ANDROID_ISO_FILENAME}"
diff --git a/.gitea/workflows/build-prod-commercial.yml b/.gitea/workflows/build-prod-commercial.yml
index 75beb40..13b0eef 100644
--- a/.gitea/workflows/build-prod-commercial.yml
+++ b/.gitea/workflows/build-prod-commercial.yml
@@ -11,7 +11,7 @@ env:
 
 jobs:
   build-commercial:
-    runs-on: build-server
+    runs-on: orion-lxc
 
     steps:
       - name: Checkout
@@ -29,7 +29,7 @@ jobs:
           fi
 
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
 
       - name: Build commercial kiosk ISO
         run: |
@@ -41,13 +41,13 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-commercial-iso-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "COMMERCIAL_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
 
       - name: Copy commercial kiosk ISO to fileserver
         run: |
-          scp "/home/user/radiantwave/${COMMERCIAL_ISO_FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
 
       - name: Cleanup commercial kiosk ISO
-        run: rm -f "/home/user/radiantwave/${COMMERCIAL_ISO_FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${COMMERCIAL_ISO_FILENAME}"
diff --git a/.gitea/workflows/build-prod-kiosk.yml b/.gitea/workflows/build-prod-kiosk.yml
index 94c72a6..008f296 100644
--- a/.gitea/workflows/build-prod-kiosk.yml
+++ b/.gitea/workflows/build-prod-kiosk.yml
@@ -11,7 +11,7 @@ env:
 
 jobs:
   build-kiosk:
-    runs-on: build-server
+    runs-on: orion-lxc
 
     steps:
       - name: Checkout
@@ -29,7 +29,7 @@ jobs:
           fi
 
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
 
       - name: Build kiosk ISO
         run: |
@@ -41,13 +41,13 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-home-${ISO_DATE}.iso"
-          cp -L result/iso/*.iso "/home/user/radiantwave/${FILENAME}"
+          cp -L result/iso/*.iso "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "KIOSK_ISO_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
 
       - name: Copy kiosk ISO to fileserver
         run: |
-          scp "/home/user/radiantwave/${KIOSK_ISO_FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
 
       - name: Cleanup kiosk ISO
-        run: rm -f "/home/user/radiantwave/${KIOSK_ISO_FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${KIOSK_ISO_FILENAME}"
diff --git a/.gitea/workflows/build-prod-rpi.yml b/.gitea/workflows/build-prod-rpi.yml
index 34ba8bb..ec9509f 100644
--- a/.gitea/workflows/build-prod-rpi.yml
+++ b/.gitea/workflows/build-prod-rpi.yml
@@ -8,7 +8,7 @@ env:
 
 jobs:
   build-rpi:
-    runs-on: build-server
+    runs-on: orion-lxc
 
     steps:
       - name: Checkout
@@ -26,7 +26,7 @@ jobs:
           fi
 
       - name: Prepare output directory
-        run: mkdir -p /home/user/radiantwave
+        run: mkdir -p /var/lib/gitea-runner/radiantwave
 
       - name: Build Raspberry Pi image
         run: |
@@ -38,13 +38,13 @@ jobs:
         run: |
           ISO_DATE=$(date +%Y-%m-%d_%H-%M-%S)
           FILENAME="radiantwave-rpi-${ISO_DATE}.img.zst"
-          cp -L result/sd-image/*.img.zst "/home/user/radiantwave/${FILENAME}"
+          cp -L result/sd-image/*.img.zst "/var/lib/gitea-runner/radiantwave/${FILENAME}"
           echo "RPI_IMAGE_FILENAME=${FILENAME}" >> "$GITHUB_ENV"
 
       - name: Copy Raspberry Pi image to fileserver
         run: |
-          scp "/home/user/radiantwave/${RPI_IMAGE_FILENAME}" \
-            radiantwave-infra:/mnt/infrastructure_data/files/images/
+          scp "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}" \
+            157.245.124.103:/mnt/infrastructure_data/files/images/
 
       - name: Cleanup Raspberry Pi image
-        run: rm -f "/home/user/radiantwave/${RPI_IMAGE_FILENAME}"
+        run: rm -f "/var/lib/gitea-runner/radiantwave/${RPI_IMAGE_FILENAME}"
diff --git a/UPDATES.md b/UPDATES.md
index 4dae974..cfef8bb 100644
--- a/UPDATES.md
+++ b/UPDATES.md
@@ -3,7 +3,7 @@ Implemented (both repos on dev)
 Checkpoints (return points if something fails):
 - radiantwave → tag pre-live-update @ d84307b
 - KioskConfig → tag pre-live-update @ b8d0f59
-radiantwave — .gitea/workflows/dev.yml: Added a "Publish manifest" step after the Attic push. It writes {"version","storePath"} using readlink -f ./result-pkg (the exact closure pushed to the dev Attic), then scps it to radiantwave-infra:/mnt/infrastructure_data/files/radiantwave-dev/manifest.json. main.yml untouched.
+radiantwave — .gitea/workflows/dev.yml: Added a "Publish manifest" step after the Attic push. It writes {"version","storePath"} using readlink -f ./result-pkg (the exact closure pushed to the dev Attic), then scps it to 157.245.124.103:/mnt/infrastructure_data/files/radiantwave-dev/manifest.json. main.yml untouched.
 KioskConfig:
 - New radiantwave-updater.nix module: tmpfiles seed (L /var/lib/radiantwave/current → <baked-in baseline>), a systemd oneshot service (curl manifest → nix copy --from dev Attic, never builds → atomic mv -T swap), and a 2-min persistent timer.
 - flake.nix: imports the module in both builders and enables it on all 4 -dev variants (radiantwavekiosk-dev, -commercial-dev, -android-dev, -rpi-dev) pointing at the dev manifest/attic.
diff --git a/build-rpi.sh b/build-rpi.sh
index 9a31b67..0b803ed 100755
--- a/build-rpi.sh
+++ b/build-rpi.sh
@@ -6,16 +6,19 @@ TIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")
 FILENAME="radiantwave-raspberrypi-${TIMESTAMP}.img.zst"
 REPO="$(pwd)"
 NIX_STORE="kiosk-nix-store"
+NIX_STATE="kiosk-nix-state"
 
 echo "==> Building ${CONFIG}..."
 echo "==> Output: ${REPO}/${FILENAME}"
 echo ""
 
 podman volume create "${NIX_STORE}" 2>/dev/null || true
+podman volume create "${NIX_STATE}" 2>/dev/null || true
 
 podman run --rm \
     -v "${REPO}:/repo" \
     -v "${NIX_STORE}:/nix/store" \
+    -v "${NIX_STATE}:/nix/var/nix" \
     -w /repo \
     nixos/nix:latest \
     sh -c '
@@ -23,8 +26,8 @@ podman run --rm \
         mkdir -p /etc/nix
         echo "experimental-features = nix-command flakes" > /etc/nix/nix.conf
         echo "accept-flake-config = true" >> /etc/nix/nix.conf
-        echo "extra-substituters = https://cache.nixos.org https://nixos-raspberrypi.cachix.org" >> /etc/nix/nix.conf
-        echo "extra-trusted-public-keys = nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI=" >> /etc/nix/nix.conf
+         echo "extra-substituters = https://cache.nixos.org https://nixos-raspberrypi.cachix.org https://attic.radiantwavetech.com/radiantwave https://attic.radiantwavetech.com/radiantwave-dev" >> /etc/nix/nix.conf
+         echo "extra-trusted-public-keys = nixos-raspberrypi.cachix.org-1:4iMO9LXa8BqhU+Rpg6LQKiGa2lsNh/j2oiYLNOQ5sPI= radiantwave:QADrjpBWJssTZ3KmiZtcWEf4uAm66oOlHmtQI3jkrgA= radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0=" >> /etc/nix/nix.conf
         echo "max-jobs = 4" >> /etc/nix/nix.conf
 
         echo "==> Building sdImage (first run slow, cached after)..."
@@ -34,7 +37,7 @@ podman run --rm \
             --print-build-logs
 
         echo "==> Build complete, copying..."
-        cp result/sd-image/*.img* /repo/'${FILENAME}'
+         cp result/sd-image/*.img.zst /repo/'${FILENAME}'
         echo "==> Done: ${FILENAME}"
         ls -lh /repo/'${FILENAME}'
     '
diff --git a/configuration.nix b/configuration.nix
index 6838a40..ca58231 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -35,7 +35,7 @@ in
   # --- RadiantWave splash: Plymouth from boot until the app's first frame ---
   boot.plymouth.enable = true;
   boot.plymouth.theme = "radiantwave";
-  boot.plymouth.themePackages = [ radiantwavePlymouth ];
+  boot.plymouth.themePackages = [ (radiantwavePlymouth pkgs) ];
 
   # Silence the kernel/initrd output behind the splash. The module adds
   # "splash" itself; we keep "quiet" plus show_status=false and loglevel 0.
diff --git a/flake.nix b/flake.nix
index b3082c4..56d80e6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -28,30 +28,31 @@
       # at build time (librsvg), so the theme is hermetic and resolution-
       # independent. The .plymouth file's /usr paths are rewritten to $out
       # (the NixOS module's initrd fixup rewrites store paths again).
-      radiantwavePlymouth = pkgs.stdenv.mkDerivation {
-        pname = "radiantwave-plymouth";
-        version = "1.0.0";
+      mkRadiantwavePlymouth = targetPkgs:
+        targetPkgs.stdenv.mkDerivation {
+          pname = "radiantwave-plymouth";
+          version = "1.0.0";
 
-        nativeBuildInputs = [ pkgs.librsvg ];
+          nativeBuildInputs = [ targetPkgs.librsvg ];
 
-        src = ./assets/RWT-Circular-Color-ForOnDark.svg;
-        dontUnpack = true;
+          src = ./assets/RWT-Circular-Color-ForOnDark.svg;
+          dontUnpack = true;
 
-        buildPhase = ''
-          mkdir -p $out/share/plymouth/themes/radiantwave
-          rsvg-convert \
-            --keep-aspect-ratio \
-            --background-color=#111318 \
-            --width=1280 \
-            --height=720 \
-            --output=$out/share/plymouth/themes/radiantwave/splash.png \
-            $src
-          sed 's,/usr/,'"$out"'/,g' ${./plymouth-theme/radiantwave.plymouth} \
-            > $out/share/plymouth/themes/radiantwave/radiantwave.plymouth
-          cp ${./plymouth-theme/radiantwave.script} \
-            $out/share/plymouth/themes/radiantwave/radiantwave.script
-        '';
-      };
+          buildPhase = ''
+            mkdir -p $out/share/plymouth/themes/radiantwave
+            rsvg-convert \
+              --keep-aspect-ratio \
+              --background-color=#111318 \
+              --width=1280 \
+              --height=720 \
+              --output=$out/share/plymouth/themes/radiantwave/splash.png \
+              $src
+            sed 's,/usr/,'"$out"'/,g' ${./plymouth-theme/radiantwave.plymouth} \
+              > $out/share/plymouth/themes/radiantwave/radiantwave.plymouth
+            cp ${./plymouth-theme/radiantwave.script} \
+              $out/share/plymouth/themes/radiantwave/radiantwave.script
+          '';
+        };
 
       revision = self.rev or self.dirtyRev or null;
 
@@ -109,7 +110,7 @@
           specialArgs = {
             inherit radiantwave;
             inherit upgradeFlakeRef;
-            inherit radiantwavePlymouth;
+            radiantwavePlymouth = mkRadiantwavePlymouth;
           };
 
           modules = [
@@ -144,7 +145,7 @@
           specialArgs = {
             inherit radiantwave upgradeFlakeRef;
             inherit nixos-raspberrypi;
-            inherit radiantwavePlymouth;
+            radiantwavePlymouth = mkRadiantwavePlymouth;
           };
 
           modules = [