diff --git a/.gitea/workflows/iso-builder.yml b/.gitea/workflows/iso-builder.yml
index 8973549..7080ca4 100644
--- a/.gitea/workflows/iso-builder.yml
+++ b/.gitea/workflows/iso-builder.yml
@@ -48,21 +48,29 @@ jobs:
           nix build --print-out-paths \
             .#nixosConfigurations.${{ matrix.host }}-iso.config.system.build.isoImage \
             --out-link result-iso 2>&1 | tee /tmp/nix-build.log
-          # The .iso file is inside the build result (result-iso is a symlink to the nix store)
+          # The .iso file is inside the build result at iso/*.iso
+          # Do NOT use `find -L` — it follows symlinks into the nix store and
+          # may pick up .iso files from build dependencies instead of the real ISO.
           mkdir -p iso-result
-          ISO_SRC=$(find -L result-iso -name '*.iso' -type f | head -n 1)
+          ISO_SRC=$(ls result-iso/iso/*.iso 2>/dev/null | head -n 1)
           if [ -z "$ISO_SRC" ]; then
-            echo "No ISO found — checking build output for clues..."
+            echo "No ISO found at result-iso/iso/*.iso — checking build output for clues..."
             cat /tmp/nix-build.log
             ls -la result-iso/ || true
-            find -L result-iso -maxdepth 3 -type f 2>/dev/null || true
+            ls -la result-iso/iso/ || true
+            exit 1
+          fi
+          # Verify it's actually a bootable ISO 9660 image before proceeding
+          if ! file "$ISO_SRC" | grep -q "ISO 9660"; then
+            echo "ERROR: $ISO_SRC is not an ISO 9660 image:"
+            file "$ISO_SRC"
             exit 1
           fi
           cp "$ISO_SRC" "iso-result/"
 
       - name: Show ${{ matrix.host }} ISO info
         run: |
-          ISO_SRC=$(find -L iso-result -name '*.iso' -type f | head -n 1)
+          ISO_SRC=$(ls iso-result/*.iso 2>/dev/null | head -n 1)
           if [ -z "$ISO_SRC" ]; then
             echo "No ISO found under iso-result"
             ls -la iso-result || true
@@ -71,6 +79,9 @@ jobs:
           echo "ISO built successfully:"
           ls -lh "$ISO_SRC"
           echo ""
+          echo "File type:"
+          file "$ISO_SRC"
+          echo ""
           echo "SHA256:"
           sha256sum "$ISO_SRC"
 
@@ -78,7 +89,7 @@ jobs:
         run: |
           set -euo pipefail
           mkdir -p iso-result/artifact
-          ISO_SRC=$(find -L iso-result -name '*.iso' -type f | head -n 1)
+          ISO_SRC=$(ls iso-result/*.iso 2>/dev/null | head -n 1)
           if [ -z "$ISO_SRC" ]; then
             echo "No ISO found under iso-result"
             ls -la iso-result || true
diff --git a/flake.nix b/flake.nix
index 1c067fe..8621dbe 100644
--- a/flake.nix
+++ b/flake.nix
@@ -225,6 +225,7 @@
           git
           nil
           bun
+          xorriso
         ];
       };
     });
diff --git a/hosts/eva-02/configuration.nix b/hosts/eva-02/configuration.nix
index 0a0af16..f7732bb 100644
--- a/hosts/eva-02/configuration.nix
+++ b/hosts/eva-02/configuration.nix
@@ -92,6 +92,7 @@
       "modrinth"
       "moonlight"
       "obsidian"
+      "pangolin"
       "scroll-reverser"
       "signal"
       "steam"