diff --git a/.gitea/workflows/main.yml b/.gitea/workflows/main.yml
index 0dab599..2aad87b 100644
--- a/.gitea/workflows/main.yml
+++ b/.gitea/workflows/main.yml
@@ -41,10 +41,17 @@ jobs:
       # checks is keyed per-system (checks.<system>.default); nix build's
       # #attr shorthand can't resolve it, so resolve the current system inline.
       # --impure lets the flake read APP_VERSION via builtins.getEnv
-      # (pure evals always get the package defaults). The offline test suite
-      # runs in the package's checkPhase.
+      # (pure evals always get the package defaults).
+      - name: Build package
+        run: |
+          nix build -L ".#packages.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-pkg
+      # The offline test suite runs in the check derivation's checkPhase.
+      # This is a separate build/output from the package itself.
       - name: Build + offline test suite
-        run: nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" --impure
+        run: |
+          nix build -L ".#checks.$(nix eval --impure --raw --expr 'builtins.currentSystem').default" \
+            --impure --out-link result-checks
 
       - name: Live portal tests
         env:
@@ -59,10 +66,11 @@ jobs:
             ./build/test_license_service
           '
 
-      # Release closure lands in the release cache.
+      # Release closure (the actual package, not the check output) lands in the
+      # release cache.
       - name: Push to Attic release cache
         env:
           ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN_PROD }}
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
-          attic push radiantwave:radiantwave ./result
+          attic push radiantwave:radiantwave ./result-pkg