diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index 1eaab47..83cef73 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -67,11 +67,13 @@ environment:
 steps:
   - name: "Resolve version & workspace"
     command: |
+      # microvm engine: the checkout is /workspace/repo and persists across
+      # steps; keep all build state under it, not /tangled/workspace (nixery).
       set -x
       VERSION="${TANGLED_REF_NAME#v}"
       echo "release version: $VERSION (ref $TANGLED_REF)"
-      mkdir -p /tangled/workspace/dist /tangled/workspace/pages-meta
-      echo "$VERSION" > /tangled/workspace/VERSION
+      mkdir -p /workspace/repo/.release/dist
+      echo "$VERSION" | tee /workspace/repo/.release/VERSION
 
   - name: "Install frontend deps (frozen)"
     command: |
@@ -84,34 +86,38 @@ steps:
 
   - name: "Build linux-amd64"
     command: |
+      cd /workspace/repo
+      VERSION=$(cat .release/VERSION)
       wails build -tags webkit2_41 -platform linux/amd64
-      install -Dm755 build/bin/sheaf /tangled/workspace/dist/sheaf-linux-amd64
+      install -Dm755 build/bin/sheaf ".release/dist/sheaf-linux-amd64"
 
   - name: "Build linux-arm64"
     command: |
+      cd /workspace/repo
+      VERSION=$(cat .release/VERSION)
       wails build -tags webkit2_41 -platform linux/arm64
-      install -Dm755 build/bin/sheaf /tangled/workspace/dist/sheaf-linux-arm64
+      install -Dm755 build/bin/sheaf ".release/dist/sheaf-linux-arm64"
       # and keep an amd64 build around for the .pkg.tar.zst below
       wails build -tags webkit2_41 -platform linux/amd64
 
   - name: "Compress binaries (upx)"
     command: |
-      upx --lzma -9 /tangled/workspace/dist/sheaf-linux-amd64 || true
-      upx --lzma -9 /tangled/workspace/dist/sheaf-linux-arm64 || true
-      ls -la /tangled/workspace/dist/
+      cd /workspace/repo
+      upx --lzma -9 .release/dist/sheaf-linux-amd64 || true
+      upx --lzma -9 .release/dist/sheaf-linux-arm64 || true
+      ls -la .release/dist/
 
   - name: "Package archives, checksums, source tarball"
     command: |
       set -e
-      DIST=/tangled/workspace/dist
-      cd "$DIST"
+      cd /workspace/repo
+      VERSION=$(cat .release/VERSION)
+      DIST=.release/dist
       for arch in amd64 arm64; do
-        tar -C "$DIST" -czf "sheaf-linux-${arch}.tar.gz" "sheaf-linux-${arch}"
-        zip -q -j "sheaf-linux-${arch}.zip" "$DIST/sheaf-linux-${arch}"
+        tar -C "$DIST" -czf "$DIST/sheaf-linux-${arch}.tar.gz" -C "$DIST" "sheaf-linux-${arch}"
+        (cd "$DIST" && zip -q -j "sheaf-linux-${arch}.zip" "sheaf-linux-${arch}")
       done
-      # uncompressed copies keep a raw binary available for direct download
-      sha256sum sheaf-linux-* > SHA256SUMS
-      cd /tangled/workspace/repo
+      (cd "$DIST" && sha256sum sheaf-linux-* > SHA256SUMS)
       git archive --format=tar.gz --prefix="sheaf-${VERSION}/" \
         -o "$DIST/sheaf-${VERSION}-source.tar.gz" "v${VERSION}"
       ls -la "$DIST"
@@ -120,15 +126,18 @@ steps:
     command: |
       # nixos has no makepkg/pacman; scripts/make-pkg.sh assembles
       # .pkg.tar.zst from the freshly built amd64 binary + packaging/linux.
-      bash scripts/make-pkg.sh "$VERSION" build/bin/sheaf /tangled/workspace/dist
-      tar -tf /tangled/workspace/dist/sheaf-bin-*.pkg.tar.zst | head
-      # add it to the checksums line-up
-      (cd /tangled/workspace/dist && sha256sum sheaf-bin-*.pkg.tar.zst >> SHA256SUMS)
+      cd /workspace/repo
+      VERSION=$(cat .release/VERSION)
+      bash scripts/make-pkg.sh "$VERSION" build/bin/sheaf .release/dist
+      tar -tf .release/dist/sheaf-bin-*.pkg.tar.zst | head
+      (cd .release/dist && sha256sum sheaf-bin-*.pkg.tar.zst >> SHA256SUMS)
 
   - name: "Publish to pages repo (auto-deploys katsuricata.tngl.io)"
     command: |
       set -euo pipefail
-      WORK=/tangled/workspace
+      cd /workspace/repo
+      VERSION=$(cat .release/VERSION)
+      WORK=.release
       DEPLOY="$WORK/pages-deploy"
       # dedicated passphrase-less deploy key, stored as a repo secret.
       # the public half must be on your Tangled account SSH keys.
@@ -149,11 +158,11 @@ steps:
 
       # regenerate every index.html (root, /sheaf/, /sheaf/vX.Y.Z/) from the
       # on-disk tree + deploy-history meta, so indexes always match reality.
-      python3 scripts/make-indexes.py \
+      python3 "$OLDPWD/scripts/make-indexes.py" \
         --repo-root "$DEPLOY" \
         --project sheaf \
         --version "v${VERSION}" \
-        --tag-sha "$(git -C /tangled/workspace/repo rev-parse HEAD)" \
+        --tag-sha "$(git rev-parse HEAD)" \
         --source-url "https://tangled.org/katsuricata.com/Sheaf"
 
       git config user.email "spindle@katsuricata.com"
@@ -173,7 +182,8 @@ steps:
       # blob and creates an sh.tangled.repo.artifact record keyed by the
       # annotated tag object.
       set -euo pipefail
-      ARTIFACT_PATH="/tangled/workspace/dist/sheaf-linux-amd64.tar.gz"
+      cd /workspace/repo
+      ARTIFACT_PATH=".release/dist/sheaf-linux-amd64.tar.gz"
       ARTIFACT_NAME="sheaf-linux-amd64.tar.gz"
 
       session=$(curl -fsS -X POST "$PDS/xrpc/com.atproto.server.createSession" \