diff --git a/.forgejo/workflows/main.yaml b/.forgejo/workflows/main.yaml
index a4acf13..9962c80 100644
--- a/.forgejo/workflows/main.yaml
+++ b/.forgejo/workflows/main.yaml
@@ -1,12 +1,10 @@
 ---
-name: 'main'
-
 on:
   push:
   workflow_dispatch:
 
 jobs:
-  main:
+  test:
     runs-on: 'self-hosted'
     steps:
       - uses: 'actions/checkout@v4'
@@ -19,6 +17,16 @@ jobs:
       - name: 'check'
         run: |
           make check no-dirty
+  build:
+    if: "${{ startsWith(github.ref, 'refs/tags/') }}"
+    needs:
+      - 'test'
+    runs-on: 'self-hosted'
+    steps:
+      - uses: 'actions/checkout@v4'
+      - uses: 'actions/setup-go@v5'
+        with:
+          go-version-file: 'go.mod'
       - name: 'build'
         run: |
           printf '%s' "$GIT_CRYPT_SECRET" | base64 -d > secret
@@ -28,15 +36,13 @@ jobs:
           GIT_CRYPT_SECRET: '${{ secrets.GIT_CRYPT }}'
       #- uses: 'actions/upload-artifact@v4'
       - uses: 'forgejo/upload-artifact@v4'
-        if: "${{ startsWith(github.ref, 'refs/tags/') }}"
         with:
           if-no-files-found: 'error'
           name: 'ods'
           path: 'ods'
   deploy:
-    if: "${{ startsWith(github.ref, 'refs/tags/') }}"
     needs:
-      - 'main'
+      - 'build'
     runs-on: 'self-hosted'
     steps:
       #- uses: 'actions/download-artifact@v4'
@@ -44,13 +50,16 @@ jobs:
         with:
           name: 'ods'
       - run: |
-          make deploy
+          umask 077
+          printf '%s' "$SSH_PRIVATE_KEY" | base64 -d > private_key
+          SSHOPTS="-i private_key -o StrictHostKeyChecking=accept-new"
+          rsync -e "ssh ${SSHOPTS}" ods ods@ods.adyxax.org:
+          ssh ${SSHOPTS} ods@ods.adyxax.org "chmod +x ods; systemctl --user restart ods"
         env:
           SSH_PRIVATE_KEY: '${{ secrets.SSH_PRIVATE_KEY }}'
   publish:
-    if: "${{ startsWith(github.ref, 'refs/tags/') }}"
     needs:
-      - 'main'
+      - 'build'
     runs-on: 'self-hosted'
     steps:
       #- uses: 'actions/download-artifact@v4'
@@ -65,4 +74,4 @@ jobs:
           release-dir: './'
           token: '${{ env.GITHUB_TOKEN }}'
           hide-archive-link: true
-          prerelease: false
+          prerelease: true
diff --git a/GNUmakefile b/GNUmakefile
index 3695969..2e974e2 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -37,17 +37,8 @@ push: tidy no-dirty check ## push changes to git remote
 
 .PHONY: deploy
 deploy: build ## deploy changes to the production server
-	umask 077
-	if [ -n "$${SSH_PRIVATE_KEY:-}" ]; then
-	    cleanup() {
-	        rm -f private_key
-	    }
-	    trap cleanup EXIT
-	    printf '%s' "$$SSH_PRIVATE_KEY" | base64 -d > private_key
-	    SSHOPTS="-i private_key -o StrictHostKeyChecking=accept-new"
-	fi
-	rsync -e "ssh $${SSHOPTS:-}" ./ods ods@ods.adyxax.org:
-	ssh $${SSHOPTS:-} ods@ods.adyxax.org "chmod +x ods; systemctl --user restart ods"
+	rsync ./ods ods@ods.adyxax.org:
+	ssh ods@ods.adyxax.org "systemctl --user restart ods"
 
 ##### Utils ####################################################################
 .PHONY: confirm