diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 318624bb..2c172122 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -40,6 +40,14 @@ jobs:
           echo EOF
         } | tee -a $GITHUB_ENV
 
+    - name: Checkout ci-artifacts
+      uses: actions/checkout@v4
+      with:
+        repository: commaai/ci-artifacts
+        ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }}
+        path: ${{ github.workspace }}/ci-artifacts
+        ref: master
+
     - name: Get kernel submodule ref
       id: kernel-submodule
       run: echo "ref=$(git ls-tree HEAD | awk '$4 == "agnos-kernel-sdm845"' | awk '{print $3}')" | tee -a $GITHUB_OUTPUT
@@ -53,26 +61,42 @@ jobs:
     - name: Build kernel
       run: ./build_kernel.sh
 
-    - name: Upload artifact boot.img
-      uses: actions/upload-artifact@v4
-      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
-      with:
-        name: boot.img
-        path: output/boot.img
-
-    - name: Upload artifact kernel modules
-      uses: actions/upload-artifact@v4
-      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
-      with:
-        name: kernel-modules
-        path: output/*.ko
-
     - name: Build system
       run: ./build_system.sh
 
-    - name: Upload artifact system.img
-      uses: actions/upload-artifact@v4
+    - name: Package and OTA push
       if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
+      env:
+        AGNOS_UPDATE_URL: https://raw.githubusercontent.com/commaai/ci-artifacts/agnos-builder/pr-${{ github.event.number }}/
+      run: |
+        sudo apt-get install -y android-sdk-libsparse-utils
+        scripts/package_ota.py
+
+    - name: Copy and push boot, system and agnos.json
+      if: false
+      working-directory: ${{ github.workspace }}/ci-artifacts
+      run: |
+        cp ${{ github.workspace }}/output/ota/*.img.xz .
+        cp ${{ github.workspace }}/output/ota/ota.json agnos.json
+        git checkout -b agnos-builder/pr-${{ github.event.number }}
+        git config user.name "GitHub Actions Bot"
+        git config user.email "<>"
+        git add ${{ github.workspace }}/ci-artifacts/*
+        git commit -m "build artifacts for PR #${{ github.event.number }}"
+        git push origin agnos-builder/pr-${{ github.event.number }} --force
+
+    - name: Comment on PR
+      if: false
+      uses: thollander/actions-comment-pull-request@v2
       with:
-        name: system.img
-        path: output/system.img
+        message: |
+          <!-- _(run_id **${{ github.run_id }}**)_ -->
+          ## Build agnos.json
+          Download <a href="https://raw.githubusercontent.com/commaai/ci-artifacts/agnos-builder/pr-${{ github.event.number }}/agnos.json" target="_blank">agnos.json</a> and replace `openpilot/system/hardware/tici/agnos.json` in your openpilot branch.
+
+          If you need to flash locally, you can download the <a href="https://github.com/commaai/ci-artifacts/tree/agnos-builder/pr-${{ github.event.number }}" target="_blank">images</a> and unarchive them in `agnos-builder/output` and flash with `./flash_all.sh`.
+
+          ---
+        comment_tag: run_id
+        pr_number: ${{ github.event.number }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/scripts/package_ota.py b/scripts/package_ota.py
index b0ed8b8e..a03ea21b 100755
--- a/scripts/package_ota.py
+++ b/scripts/package_ota.py
@@ -34,7 +34,7 @@ def process_file(fn, name, sparse=False, full_check=True, has_ab=True, alt=None)
   if sparse:
     with NamedTemporaryFile() as tmp_f:
       print("  converting sparse image to raw")
-      subprocess.check_call(["simg2img", fn, tmp_f.name], shell=True)
+      subprocess.check_call(["simg2img", fn, tmp_f.name])
       hash_raw = checksum(tmp_f.name)
       size = Path(tmp_f.name).stat().st_size
       print(f"  {size} bytes, hash {hash} (raw)")