diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 318624b..28beb76 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -40,6 +40,14 @@ jobs:
           echo EOF
         } | tee -a $GITHUB_ENV
 
+    - name: Checkout ci-artifacts
+      uses: actions/checkout@v4
+      with:
+        repository: commaai/ci-artifacts
+        ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }}
+        path: ${{ github.workspace }}/ci-artifacts
+        ref: master
+
     - name: Get kernel submodule ref
       id: kernel-submodule
       run: echo "ref=$(git ls-tree HEAD | awk '$4 == "agnos-kernel-sdm845"' | awk '{print $3}')" | tee -a $GITHUB_OUTPUT
@@ -53,26 +61,41 @@ jobs:
     - name: Build kernel
       run: ./build_kernel.sh
 
-    - name: Upload artifact boot.img
-      uses: actions/upload-artifact@v4
-      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
-      with:
-        name: boot.img
-        path: output/boot.img
-
-    - name: Upload artifact kernel modules
-      uses: actions/upload-artifact@v4
-      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
-      with:
-        name: kernel-modules
-        path: output/*.ko
-
     - name: Build system
       run: ./build_system.sh
 
-    - name: Upload artifact system.img
-      uses: actions/upload-artifact@v4
+    - name: Package and OTA push
       if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
+      env:
+        AGNOS_UPDATE_URL: https://raw.githubusercontent.com/commaai/ci-artifacts/agnos-builder/pr-${{ github.event.number }}/
+      run: |
+        scripts/package_ota.py
+
+    - name: Copy and push boot, system and agnos.json
+      if: false
+      working-directory: ${{ github.workspace }}/ci-artifacts
+      run: |
+        cp ${{ github.workspace }}/output/ota/*.img.xz .
+        cp ${{ github.workspace }}/output/ota/ota.json agnos.json
+        git checkout -b agnos-builder/pr-${{ github.event.number }}
+        git config user.name "GitHub Actions Bot"
+        git config user.email "<>"
+        git add ${{ github.workspace }}/ci-artifacts/*
+        git commit -m "build artifacts for PR #${{ github.event.number }}"
+        git push origin agnos-builder/pr-${{ github.event.number }} --force
+
+    - name: Comment on PR
+      if: false
+      uses: thollander/actions-comment-pull-request@v2
       with:
-        name: system.img
-        path: output/system.img
+        message: |
+          <!-- _(run_id **${{ github.run_id }}**)_ -->
+          ## Build agnos.json
+          Download <a href="https://raw.githubusercontent.com/commaai/ci-artifacts/agnos-builder/pr-${{ github.event.number }}/agnos.json" target="_blank">agnos.json</a> and replace `openpilot/system/hardware/tici/agnos.json` in your openpilot branch.
+
+          If you need to flash locally, you can download the <a href="https://github.com/commaai/ci-artifacts/tree/agnos-builder/pr-${{ github.event.number }}" target="_blank">images</a> and unarchive them in `agnos-builder/output` and flash with `./flash_all.sh`.
+
+          ---
+        comment_tag: run_id
+        pr_number: ${{ github.event.number }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/scripts/package_ota.py b/scripts/package_ota.py
index b0ed8b8..d10a3d7 100755
--- a/scripts/package_ota.py
+++ b/scripts/package_ota.py
@@ -5,11 +5,11 @@ import hashlib
 import subprocess
 from copy import deepcopy
 from pathlib import Path
-from tempfile import NamedTemporaryFile
 
 ROOT = Path(__file__).parent.parent
 OUTPUT_DIR = ROOT / "output"
 OTA_OUTPUT_DIR = OUTPUT_DIR / "ota"
+BUILD_DIR = ROOT / "build"
 
 AGNOS_UPDATE_URL = os.getenv("AGNOS_UPDATE_URL", "https://commadist.azureedge.net/agnosupdate")
 AGNOS_STAGING_UPDATE_URL = os.getenv("AGNOS_STAGING_UPDATE_URL", "https://commadist.azureedge.net/agnosupdate-staging")
@@ -32,12 +32,15 @@ def process_file(fn, name, sparse=False, full_check=True, has_ab=True, alt=None)
   print(f"  {size} bytes, hash {hash}")
 
   if sparse:
-    with NamedTemporaryFile() as tmp_f:
-      print("  converting sparse image to raw")
-      subprocess.check_call(["simg2img", fn, tmp_f.name], shell=True)
-      hash_raw = checksum(tmp_f.name)
-      size = Path(tmp_f.name).stat().st_size
-      print(f"  {size} bytes, hash {hash} (raw)")
+    raw_img = BUILD_DIR / "system.img.raw"
+    if raw_img.exists():
+      print("  using existing raw image")
+      hash_raw = checksum(raw_img)
+      size = raw_img.stat().st_size
+    else:
+      print("Error: existing raw image not found")
+      exit(1)
+    print(f"  {size} bytes, hash {hash_raw} (raw)")
 
   print("  compressing")
   xz_fn = OTA_OUTPUT_DIR / f"{fn.stem}-{hash_raw}.img.xz"
diff --git a/userspace/usr/comma/shims/pip3 b/userspace/usr/comma/shims/pip3
new file mode 120000
index 0000000..4d6aa0d
--- /dev/null
+++ b/userspace/usr/comma/shims/pip3
@@ -0,0 +1 @@
+pip
\ No newline at end of file