diff --git a/.gitea/workflows/main.yml b/.gitea/workflows/main.yml
index 2aad87b..388b3e8 100644
--- a/.gitea/workflows/main.yml
+++ b/.gitea/workflows/main.yml
@@ -2,7 +2,7 @@ name: build-main
 
 on:
   # Manual only. Dispatch against main: build, run the offline test suite,
-  # publish to the release Attic cache.
+  # publish to the release Attic cache and live-update manifest.
   workflow_dispatch:
 
 jobs:
@@ -74,3 +74,17 @@ jobs:
         run: |
           attic login radiantwave https://attic.radiantwavetech.com "$ATTIC_TOKEN"
           attic push radiantwave:radiantwave ./result-pkg
+
+      # Publish the manifest production kiosks poll for live app updates.
+      # `storePath` must match exactly the closure pushed to the release Attic
+      # cache above (readlink resolves the result-pkg out-link symlink to its
+      # real /nix/store path), so a kiosk can `nix copy --from` it without ever
+      # building from source. Upload mirrors the ISO scp pattern to the
+      # fileserver via the build-server's `radiantwave-infra` SSH alias.
+      - name: Publish manifest
+        run: |
+          STOREPATH=$(readlink -f ./result-pkg)
+          printf '{"version":"%s","storePath":"%s"}\n' "${{ env.APP_VERSION }}" "$STOREPATH" > manifest.json
+          cat manifest.json
+          scp manifest.json \
+            radiantwave-infra:/mnt/infrastructure_data/files/radiantwave/manifest.json