diff --git a/.gitea/workflows/dev.yml b/.gitea/workflows/dev.yml
index 62b4f66..e603c25 100644
--- a/.gitea/workflows/dev.yml
+++ b/.gitea/workflows/dev.yml
@@ -1,11 +1,9 @@
 name: build-dev
-
 on:
   # Every push to dev: build, run the offline test suite, publish to the
   # dev Attic cache.
   push:
     branches: [dev]
-
 jobs:
   nix-build:
     runs-on: build-server
@@ -20,7 +18,6 @@ jobs:
             "${{ gitea.server_url }}/${{ gitea.repository }}.git" .
           test -f flake.nix
           git log --oneline -1
-
       - name: Inspect workspace
         run: |
           pwd
@@ -29,22 +26,26 @@ jobs:
           git remote -v 2>&1 || true
           git describe --tags --always 2>&1 || true
           test -f flake.nix && echo "flake.nix present" || echo "NO flake.nix"
-
       # Dev builds fingerprint as the short commit hash.
       # Persisted via GITHUB_ENV so the impure nix eval below reads it via
       # builtins.getEnv.
       - name: Compute version
         run: |
           echo "APP_VERSION=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
-
       # checks is keyed per-system (checks.<system>.default); nix build's
       # #attr shorthand can't resolve it, so resolve the current system inline.
       # --impure lets the flake read APP_VERSION via builtins.getEnv
-      # (pure evals always get the package defaults). The offline test suite
-      # runs in the package's checkPhase.
+      # (pure evals always get the package defaults).
+      - name: Build package
+        run: |
+          nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-pkg
+      # The offline test suite runs in the check derivation's checkPhase.
+      # This is a separate build/output from the package itself.
       - name: Build + offline test suite
-        run: nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" --impure
-
+        run: |
+          nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-checks
       - name: Live portal tests
         env:
           RWT_LIVE_ACCOUNT_EMAIL: ${{ secrets.RWT_LIVE_ACCOUNT_EMAIL }}
@@ -57,11 +58,11 @@ jobs:
             ./build/test_api_client
             ./build/test_license_service
           '
-
-      # Dev closure lands in the dev cache.
+      # Dev closure (the actual package, not the check output) lands in the
+      # dev cache.
       - name: Push to Attic dev cache
         env:
           ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_DEV }}
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave-dev ./result
+          attic push radiantwave:radiantwave-dev ./result-pkg