diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..9b83554
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,143 @@
+---
+name: "Build"
+on:
+  pull_request:
+  push:
+jobs:
+  pre-job:
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      should_skip: ${{ steps.skip_check.outputs.should_skip }}
+    steps:
+      - id: skip_check
+        uses: fkirc/skip-duplicate-actions@04a1aebece824b56e6ad6a401d015479cd1c50b3
+        with:
+          concurrent_skipping: "same_content_newer"
+          cancel_others: "true"
+  find-jobs:
+    runs-on: ubuntu-latest
+    needs: pre-job
+    permissions:
+      contents: read
+    if: needs.pre-job.outputs.should_skip != 'true'
+    outputs:
+      packages: ${{ steps.x86_64.outputs.packages }}
+      tests: ${{ steps.tests.outputs.tests }}
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-nix
+      - name: Find package jobs
+        id: x86_64
+        run: echo "packages=$(nix eval .#hydraJobs.packages.x86_64-linux --apply "builtins.attrNames" --json)" >> "$GITHUB_OUTPUT"
+      - name: Find test Jobs
+        id: tests
+        run: echo "tests=$(nix eval .#hydraJobs.tests --apply "builtins.attrNames" --json)" >> "$GITHUB_OUTPUT"
+  build-key-agent-aarch64:
+    runs-on: blacksmith-8vcpu-ubuntu-2404-arm
+    permissions: {}
+    needs: pre-job
+    if: needs.pre-job.outputs.should_skip != 'true'
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-nix
+      - name: Build
+        run: nix build --print-build-logs --print-out-paths .#packages.aarch64-linux.agent > out.paths
+      - name: Push
+        run: |
+          echo "$SIGNING_KEY" | nix store sign --key-file /dev/stdin "$(< out.paths)"
+          nix copy --to "s3://wire-cache?write-nar-listing=1&ls-compression=br&log-compression=br&endpoint=s3.us-east-005.backblazeb2.com" "$(< out.paths)"
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CACHE_AWS_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CACHE_AWS_KEY }}
+  build-key-agent-x86_64:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    permissions: {}
+    needs: pre-job
+    if: needs.pre-job.outputs.should_skip != 'true'
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-nix
+      - name: Build
+        run: nix build --print-build-logs --print-out-paths .#packages.x86_64-linux.agent > out.paths
+      - name: Push
+        run: |
+          echo "$SIGNING_KEY" | nix store sign --key-file /dev/stdin "$(< out.paths)"
+          nix copy --to "s3://wire-cache?write-nar-listing=1&ls-compression=br&log-compression=br&endpoint=s3.us-east-005.backblazeb2.com" "$(< out.paths)"
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CACHE_AWS_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CACHE_AWS_KEY }}
+  build:
+    runs-on: ${{ matrix.arch.runner }}
+    needs:
+      - find-jobs
+      - build-key-agent-x86_64
+      - build-key-agent-aarch64
+    permissions: {}
+    strategy:
+      matrix:
+        package: ${{ fromJSON(needs.find-jobs.outputs.packages) }}
+        arch:
+          - id: x86_64-linux
+            runner: blacksmith-8vcpu-ubuntu-2404
+          # disabled arm building,
+          # currently handled by cachix and for development purposes i only use
+          # x86_64
+          #
+          # - id: aarch64-linux
+          #   runner: blacksmith-8vcpu-ubuntu-2404-arm
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-nix
+      - name: Build
+        run: |
+          nix build --print-build-logs --print-out-paths .#hydraJobs.packages.${ARCH}.${MATRIX_PACKAGE} > out.paths
+        env:
+          MATRIX_PACKAGE: ${{ matrix.package }}
+          ARCH: ${{ matrix.arch.id }}
+      - name: Push
+        run: |
+          echo "$SIGNING_KEY" | nix store sign --key-file /dev/stdin "$(< out.paths)"
+          nix copy --to "s3://wire-cache?write-nar-listing=1&ls-compression=br&log-compression=br&endpoint=s3.us-east-005.backblazeb2.com" "$(< out.paths)"
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CACHE_AWS_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CACHE_AWS_KEY }}
+  tests:
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    needs:
+      - find-jobs
+      - build-key-agent-x86_64
+    permissions: {}
+    strategy:
+      matrix:
+        test: ${{ fromJSON(needs.find-jobs.outputs.tests) }}
+    steps:
+      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-nix
+      - name: Test
+        run: |
+          nix build --print-build-logs --print-out-paths .#hydraJobs.tests.${MATRIX_TEST} > out.paths
+        env:
+          MATRIX_TEST: ${{ matrix.test }}
+      - name: Push
+        run: |
+          echo "$SIGNING_KEY" | nix store sign --key-file /dev/stdin "$(< out.paths)"
+          nix copy --to "s3://wire-cache?write-nar-listing=1&ls-compression=br&log-compression=br&endpoint=s3.us-east-005.backblazeb2.com" "$(< out.paths)"
+        env:
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.CACHE_AWS_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.CACHE_AWS_KEY }}
diff --git a/flake.nix b/flake.nix
index 6402ecc..4cc01ed 100644
--- a/flake.nix
+++ b/flake.nix
@@ -57,7 +57,7 @@
               inherit (self.packages.x86_64-linux) docs;
             }
             // lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system: {
-              inherit (self.packages.${system}) wire wire-small cargo-tests;
+              inherit (self.packages.${system}) wire wire-small;
             });
 
             tests = lib.filterAttrs (n: _: (lib.hasPrefix "vm" n)) self.checks.x86_64-linux;