diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 28beb76..2c9106a 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -10,14 +10,15 @@ concurrency:
   group: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && github.run_id || github.head_ref || github.ref }}-${{ github.workflow }}-${{ github.event_name }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
-
 jobs:
   build:
     name: build kernel and system
     runs-on: namespace-profile-arm64-8x16-2004-caching
     timeout-minutes: 60
+    permissions:
+      contents: read
+      pull-requests: write
+      actions: read
     steps:
     - uses: actions/checkout@v4
       with:
@@ -71,31 +72,12 @@ jobs:
       run: |
         scripts/package_ota.py
 
-    - name: Copy and push boot, system and agnos.json
-      if: false
-      working-directory: ${{ github.workspace }}/ci-artifacts
-      run: |
-        cp ${{ github.workspace }}/output/ota/*.img.xz .
-        cp ${{ github.workspace }}/output/ota/ota.json agnos.json
-        git checkout -b agnos-builder/pr-${{ github.event.number }}
-        git config user.name "GitHub Actions Bot"
-        git config user.email "<>"
-        git add ${{ github.workspace }}/ci-artifacts/*
-        git commit -m "build artifacts for PR #${{ github.event.number }}"
-        git push origin agnos-builder/pr-${{ github.event.number }} --force
-
-    - name: Comment on PR
-      if: false
-      uses: thollander/actions-comment-pull-request@v2
+    - name: Upload artifacts
+      if: "contains(env.LAST_COMMIT_MESSAGE, '[upload]')"
+      uses: actions/upload-artifact@v4
       with:
-        message: |
-          <!-- _(run_id **${{ github.run_id }}**)_ -->
-          ## Build agnos.json
-          Download <a href="https://raw.githubusercontent.com/commaai/ci-artifacts/agnos-builder/pr-${{ github.event.number }}/agnos.json" target="_blank">agnos.json</a> and replace `openpilot/system/hardware/tici/agnos.json` in your openpilot branch.
-
-          If you need to flash locally, you can download the <a href="https://github.com/commaai/ci-artifacts/tree/agnos-builder/pr-${{ github.event.number }}" target="_blank">images</a> and unarchive them in `agnos-builder/output` and flash with `./flash_all.sh`.
-
-          ---
-        comment_tag: run_id
-        pr_number: ${{ github.event.number }}
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        name: agnos-artifacts-${{ github.event.number }}
+        path: |
+          ${{ github.workspace }}/output/ota/*.img.xz
+          ${{ github.workspace }}/output/ota/ota.json
+        compression-level: 0
diff --git a/.github/workflows/push-and-comment.yaml b/.github/workflows/push-and-comment.yaml
new file mode 100644
index 0000000..449f730
--- /dev/null
+++ b/.github/workflows/push-and-comment.yaml
@@ -0,0 +1,68 @@
+name: push and comment
+
+on:
+  workflow_run:
+    workflows: ["build"]
+    types:
+      - completed
+
+env:
+  BUILD_JOB_NAME: "build kernel and system"
+
+jobs:
+  preview:
+    name: push and comment
+    runs-on: ubuntu-latest
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    timeout-minutes: 15
+    steps:
+      - name: Get workflow run ID
+        id: get_run_id
+        run: |
+          echo "run_id=$(curl https://api.github.com/repos/${{ github.repository }}/commits/${{ github.event.pull_request.head.sha }}/check-runs | jq -r '.check_runs[] | select(.name == "${{ env.BUILD_JOB_NAME }}") | .html_url | capture("(?<number>[0-9]+)") | .number')" >> $GITHUB_OUTPUT
+
+      - name: Checkout ci-artifacts
+        uses: actions/checkout@v4
+        with:
+          repository: commaai/ci-artifacts
+          ssh-key: ${{ secrets.CI_ARTIFACTS_DEPLOY_KEY }}
+          path: ${{ github.workspace }}/ci-artifacts
+          ref: master
+
+      - name: Download artifact
+        id: download-artifact
+        uses: dawidd6/action-download-artifact@v6
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          run_id: ${{ steps.get_run_id.outputs.run_id }}
+          search_artifacts: true
+          name: agnos-artifacts-${{ github.event.number }}
+          path: ${{ github.workspace }}/ci-artifacts
+
+      - name: Push boot, system and agnos.json
+        working-directory: ${{ github.workspace }}/ci-artifacts
+        run: |
+          mv ota.json agnos.json
+          git checkout -b agnos-builder/pr-${{ github.event.number }}
+          git config user.name "GitHub Actions Bot"
+          git config user.email "<>"
+          git add .
+          git commit -m "build artifacts for PR #${{ github.event.number }}"
+          git push origin agnos-builder/pr-${{ github.event.number }} --force
+
+      - name: Comment on PR
+        uses: thollander/actions-comment-pull-request@v2
+        with:
+          message: |
+            <!-- _(run_id **${{ github.run_id }}**)_ -->
+            ## Build agnos.json
+            Download <a href="https://raw.githubusercontent.com/commaai/ci-artifacts/agnos-builder/pr-${{ github.event.number }}/agnos.json" target="_blank">agnos.json</a> and replace `openpilot/system/hardware/tici/agnos.json` in your openpilot branch.
+
+            If you need to flash locally, you can download the <a href="https://github.com/commaai/ci-artifacts/tree/agnos-builder/pr-${{ github.event.number }}" target="_blank">images</a> and unarchive them in `agnos-builder/output` and flash with `./flash_all.sh`.
+
+            ---
+          comment_tag: run_id
+          pr_number: ${{ github.event.number }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}