diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fab6911..f5ed820 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,9 @@
-name: Compile and Publish Console
+name: Tag and Publish release
+
+# console is no longer cross-built here -- penguin-tools builds it for every
+# guest arch from this source (github:rehosting/penguin-tools#console-*) and
+# ships it in penguin-tools.tar.gz. This workflow only cuts a versioned release
+# for tracking/provenance; it publishes no binary asset.
 
 on:
   push:
@@ -6,7 +11,7 @@ on:
       - master
 
 jobs:
-  build:
+  release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -17,19 +22,10 @@ jobs:
         id: version
         with:
           use_api: true
+
       - name: Checkout code
         uses: actions/checkout@v4
 
-      - name: Build 
-        run: |
-          docker run --rm -v $PWD:/app -w /app ghcr.io/rehosting/embedded-toolchains:latest /app/build.sh
-
-      - name: Save package
-        uses: actions/upload-artifact@v4.6.2
-        with:
-          name: console
-          path: build
-
       - name: Create release
         id: create_release
         uses: actions/create-release@v1
@@ -40,19 +36,12 @@ jobs:
           release_name: Release ${{ steps.version.outputs.v-version }} ${{ github.ref }}
           body: |
             Release ${{ steps.version.outputs.v-version }} @${{ github.ref }}
+
+            Binaries are built and distributed by penguin-tools
+            (penguin-tools.tar.gz); this release carries no binary asset.
           draft: true
           prerelease: false
 
-      - name: Upload release asset
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ steps.create_release.outputs.upload_url }}
-          asset_path: ./console.tar.gz
-          asset_name: console.tar.gz
-          asset_content_type: application/gzip
-
       - name: Publish release
         uses: StuYarrow/publish-release@v1.1.2
         env:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8c670cd..361184d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,19 +1,51 @@
 name: Check that the code compiles
 
+# Build console for every guest arch through the penguin-tools Nix cross matrix
+# (the same machinery that ships it in penguin-tools.tar.gz), compiling *this*
+# checkout via --override-input. Replaces the old embedded-toolchains Docker build.
+
 on:
   pull_request:
-    branches:
-      - master
+  workflow_dispatch:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
-
+    runs-on: rehosting-arc
+    env:
+      USER: runner
+      LOGNAME: runner
+      TMPDIR: /home/runner/_work/_temp
+      XDG_CACHE_HOME: /home/runner/_work/.cache
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
+
+      - name: Prepare runner directories
+        run: mkdir -p "$TMPDIR" "$XDG_CACHE_HOME"
+
+      - name: Install dependencies
+        run: sudo apt-get update && sudo apt-get install -y curl jq xz-utils
+
+      - uses: cachix/install-nix-action@v27
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          extra_nix_config: |
+            max-jobs = 8
+            cores = 8
+
+      - name: Configure Cachix
+        uses: cachix/cachix-action@v16
+        with:
+          name: rehosting-tools
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          skipPush: ${{ github.event_name == 'pull_request' }}
 
-      - name: Build 
+      - name: Build console for all guest arches (this checkout)
         run: |
-          docker run --rm -v $PWD:/app -w /app ghcr.io/panda-re/embedded-toolchains:latest /app/build.sh
-          
\ No newline at end of file
+          set -eux
+          for a in x86_64 armel aarch64 mipsel mipseb mips64el mips64eb \
+                   powerpc64 powerpc64le riscv64 loongarch64; do
+            nix build --accept-flake-config \
+              "github:rehosting/penguin-tools#console-$a" \
+              --override-input console "path:$PWD" \
+              --no-link --print-out-paths -L
+          done