diff --git a/README.md b/README.md
index 1e6b82c..824be39 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,8 @@
 
 This is the tool to build AGNOS, our Ubuntu based OS. AGNOS runs on the [comma three devkit](https://comma.ai/shop/products/three).
 
+NOTE: the `edk2_tici` and `agnos-firmare` submodules are internal, private repos.
+
 ## Setup
 
 These tools are developed on and targeted for Ubuntu 20.04.
diff --git a/build_kernel.sh b/build_kernel.sh
index afd0886..2ea93a6 100755
--- a/build_kernel.sh
+++ b/build_kernel.sh
@@ -16,6 +16,8 @@ if git submodule status --cached agnos-kernel-sdm845/ | grep "^-"; then
 fi
 cd agnos-kernel-sdm845
 
+$DIR/tools/extract_tools.sh
+
 # Build parameters
 export ARCH=arm64
 export CROSS_COMPILE=$TOOLS/aarch64-linux-gnu-gcc/bin/aarch64-linux-gnu-
diff --git a/internal/README.md b/internal/README.md
new file mode 100644
index 0000000..ad61e89
--- /dev/null
+++ b/internal/README.md
@@ -0,0 +1,17 @@
+# internal
+
+## release checklist
+
+* CPU usage
+* shutdown
+* bootkick on ignition
+* wifi
+* modem
+* image size
+* sounds
+* python/shims works
+* clean openpilot build
+* factory reset
+ * user-prompted reset
+ * corrupt userdata
+* color calibration
diff --git a/build_and_package.sh b/internal/build_and_package.sh
similarity index 84%
rename from build_and_package.sh
rename to internal/build_and_package.sh
index 36bf1d8..aa40394 100755
--- a/build_and_package.sh
+++ b/internal/build_and_package.sh
@@ -1,5 +1,8 @@
 #!/bin/bash -e
 
+DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
+cd $DIR/..
+
 read -p "Is the kernel repo up to date? " -n 1 -r
 echo
 if [[ ! $REPLY =~ ^[Yy]$ ]]; then
@@ -18,4 +21,4 @@ fi
 cp output/wlan.ko userspace/usr/comma
 cp output/snd*.ko userspace/usr/comma/sound/
 ./build_system.sh
-./package_ota.sh
+internal/package_ota.sh
diff --git a/ota_push.sh b/internal/ota_push.sh
similarity index 90%
rename from ota_push.sh
rename to internal/ota_push.sh
index fdf593e..bf0f7ef 100755
--- a/ota_push.sh
+++ b/internal/ota_push.sh
@@ -5,25 +5,25 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
 cd $DIR
 
 # Constants
-OTA_DIR="$DIR/output/ota"
+OTA_DIR="$DIR/../output/ota"
 DATA_ACCOUNT="commadist"
 
 # Parse input
 FOUND=0
 if [ "$1" == "production" ]; then
-    OTA_JSON="$OTA_DIR/ota.json"
-    DATA_CONTAINER="agnosupdate"
-    FOUND=1
+  OTA_JSON="$OTA_DIR/ota.json"
+  DATA_CONTAINER="agnosupdate"
+  FOUND=1
 fi
 if [ "$1" == "staging" ]; then
-    OTA_JSON="$OTA_DIR/ota-staging.json"
-    DATA_CONTAINER="agnosupdate-staging"
-    FOUND=1
+  OTA_JSON="$OTA_DIR/ota-staging.json"
+  DATA_CONTAINER="agnosupdate-staging"
+  FOUND=1
 fi
 
 if [ $FOUND == 0 ]; then
-    echo "Supply either 'production' or 'staging' as first argument!"
-    exit 1
+  echo "Supply either 'production' or 'staging' as first argument!"
+  exit 1
 fi
 
 # Read update file
diff --git a/package_ota.sh b/internal/package_ota.sh
similarity index 98%
rename from package_ota.sh
rename to internal/package_ota.sh
index 42f2c14..7891975 100755
--- a/package_ota.sh
+++ b/internal/package_ota.sh
@@ -2,13 +2,12 @@
 
 # Make sure we're in the correct spot
 DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
-cd $DIR
 
-# Constants
+ROOT="$DIR/../"
 TMP_DIR="/tmp/agnos-builder-tmp"
-OUTPUT_DIR="$DIR/output"
+OUTPUT_DIR="$ROOT/output"
 OTA_OUTPUT_DIR="$OUTPUT_DIR/ota"
-FIRMWARE_DIR="$DIR/agnos-firmware"
+FIRMWARE_DIR="$ROOT/agnos-firmware"
 
 SYSTEM_IMAGE_RAW="/tmp/system.img.raw"
 SYSTEM_IMAGE="$OUTPUT_DIR/system.img"
@@ -22,6 +21,8 @@ AGNOS_STAGING_UPDATE_URL=${AGNOS_STAGING_UPDATE_URL:-https://commadist.azureedge
 OUTPUT_JSON="$OTA_OUTPUT_DIR/ota.json"
 OUTPUT_STAGING_JSON="$OTA_OUTPUT_DIR/ota-staging.json"
 
+cd $ROOT
+
 # Create dirs if non-existent
 mkdir -p $OTA_OUTPUT_DIR