diff --git a/.gitea/workflows/iso-builder.yml b/.gitea/workflows/iso-builder.yml
index e9961bb..cac5dcc 100644
--- a/.gitea/workflows/iso-builder.yml
+++ b/.gitea/workflows/iso-builder.yml
@@ -22,6 +22,7 @@ on:
 jobs:
   build-iso:
     strategy:
+      fail-fast: false
       matrix:
         host:
           #- eva-01
@@ -34,7 +35,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v27
+        uses: cachix/install-nix-action@v28
         with:
           nix_path: nixpkgs=channel:nixos-unstable
           extra_nix_config: |
@@ -42,68 +43,68 @@ jobs:
             download-buffer-size = 200000000
             auto-optimise-store = true
 
+      - name: Cache Nix store
+        uses: actions/cache@v4
+        with:
+          path: |
+            /nix/store
+            /nix/var/nix/profiles
+          key: nix-iso-${{ matrix.host }}-${{ hashFiles('flake.lock', 'hosts/**', 'flake.nix') }}
+          restore-keys: |
+            nix-iso-${{ matrix.host }}-
+            nix-iso-
+
       - name: Build ${{ matrix.host }} ISO
+        id: build
         run: |
-          # Build the ISO directly from the flake's NixOS configuration
+          set -euo pipefail
+          # Build the ISO directly from the flake's NixOS configuration.
+          # `config.system.build.isoImage` is a store path containing an `iso/`
+          # directory with the actual .iso file.
           nix build --print-out-paths \
             .#nixosConfigurations.${{ matrix.host }}-iso.config.system.build.isoImage \
             --out-link result-iso 2>&1 | tee /tmp/nix-build.log
-          # The .iso file is inside the build result at iso/*.iso
-          # Do NOT use `find -L` — it follows symlinks into the nix store and
-          # may pick up .iso files from build dependencies instead of the real ISO.
-          mkdir -p iso-result
-          ISO_SRC=$(ls result-iso/iso/*.iso 2>/dev/null | head -n 1)
+
+          # Resolve the real .iso. Do NOT use `find -L` — it follows symlinks
+          # into the nix store and may pick up .iso files from build deps.
+          ISO_SRC="$(ls result-iso/iso/*.iso 2>/dev/null | head -n 1 || true)"
           if [ -z "$ISO_SRC" ]; then
-            echo "No ISO found at result-iso/iso/*.iso — checking build output for clues..."
+            echo "::error::No ISO found at result-iso/iso/*.iso"
             cat /tmp/nix-build.log
             ls -la result-iso/ || true
             ls -la result-iso/iso/ || true
             exit 1
           fi
-          # Verify it's actually a bootable ISO 9660 image before proceeding
+
+          # Verify it's actually a bootable ISO 9660 image before proceeding.
           if ! file "$ISO_SRC" | grep -q "ISO 9660"; then
-            echo "ERROR: $ISO_SRC is not an ISO 9660 image:"
+            echo "::error::$ISO_SRC is not an ISO 9660 image:"
             file "$ISO_SRC"
             exit 1
           fi
-          cp "$ISO_SRC" "iso-result/"
 
-      - name: Show ${{ matrix.host }} ISO info
-        run: |
-          ISO_SRC=$(ls iso-result/*.iso 2>/dev/null | head -n 1)
-          if [ -z "$ISO_SRC" ]; then
-            echo "No ISO found under iso-result"
-            ls -la iso-result || true
-            exit 1
-          fi
-          echo "ISO built successfully:"
-          ls -lh "$ISO_SRC"
-          echo ""
-          echo "File type:"
-          file "$ISO_SRC"
-          echo ""
+          # Stage the ISO under a stable name in the workspace root so the
+          # upload-artifact step can reference a single file directly.
+          ISO_NAME="${{ matrix.host }}-installer.iso"
+          cp "$ISO_SRC" "$ISO_NAME"
+
+          echo "iso-path=$ISO_NAME" >> "$GITHUB_OUTPUT"
+          echo "iso-size=$(stat -c%s "$ISO_NAME")" >> "$GITHUB_OUTPUT"
+
+          echo "::group::ISO info"
+          ls -lh "$ISO_NAME"
+          file "$ISO_NAME"
           echo "SHA256:"
-          sha256sum "$ISO_SRC"
+          sha256sum "$ISO_NAME"
+          echo "::endgroup::"
 
-      - name: Prepare ${{ matrix.host }} ISO artifact
-        run: |
-          set -euo pipefail
-          mkdir -p iso-result/artifact
-          ISO_SRC=$(ls iso-result/*.iso 2>/dev/null | head -n 1)
-          if [ -z "$ISO_SRC" ]; then
-            echo "No ISO found under iso-result"
-            ls -la iso-result || true
-            exit 1
-          fi
-          ISO_BASENAME="${{ matrix.host }}-installer.iso"
-          ISO_DEST="iso-result/artifact/${ISO_BASENAME}"
-          cp "$ISO_SRC" "$ISO_DEST"
-          # Emit sha256 as a separate file and print to log
-          sha256sum "$ISO_DEST" | tee "${ISO_DEST}.sha256"
-          
       - name: Upload ${{ matrix.host }} ISO artifact
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.upload-artifact }}
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ matrix.host }}-installer-iso
-          path: iso-result/artifact/**
+          # Point directly at the .iso file so the artifact contains a single
+          # file (not a directory of files that gets zipped together).
+          path: ${{ steps.build.outputs.iso-path }}
+          if-no-files-found: error
+          compression-level: 0