diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
deleted file mode 100644
index 1634062..0000000
--- a/.github/workflows/build.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-name: "Build"
-on:
-  repository_dispatch:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-jobs:
-  images:
-    strategy:
-      fail-fast: false
-      matrix:
-        tag:
-          - nixos-22.11
-          - nixos-unstable
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - uses: cachix/install-nix-action@v20
-      with:
-        nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/nixpkgs-unstable.tar.gz
-    - name: Build image
-      run: ./build-images.sh "${{matrix.tag}}"
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/bors.toml b/bors.toml
index 9247e10..a6bf5e6 100644
--- a/bors.toml
+++ b/bors.toml
@@ -1,10 +1,5 @@
 cut_body_after = "" # don't include text from the PR body in the merge commit message
 status = [
-  # garnix
-  "Evaluate flake.nix",
-  "package netboot-nixos-2211 [x86_64-linux]",
-  "package kexec-installer-nixos-2211 [x86_64-linux]",
-  "package kexec-installer-nixos-unstable [x86_64-linux]",
-  "check kexec-installer-unstable [x86_64-linux]",
-  "package netboot-nixos-unstable [x86_64-linux]"
+  "ci/hercules/onPush/default",
+  "ci/hercules/evaluation",
 ]
diff --git a/build-images.sh b/build-images.sh
index 2a426b6..048e111 100755
--- a/build-images.sh
+++ b/build-images.sh
@@ -1,12 +1,10 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -p nix -p coreutils -p bash -p gh -i bash
-# shellcheck shell=bash
+#!/usr/bin/env bash
 set -xeuo pipefail
 shopt -s lastpipe
 
 build_netboot_image() {
   declare -r tag=$1 arch=$2 tmp=$3
-  img=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.netboot-${tag//./}")
+  img=$(nix build --extra-experimental-features 'nix-command flakes' --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.netboot-${tag//./}")
   ln -s "${img}/bzImage" "${tmp}/bzImage-${arch}"
   echo "${tmp}/bzImage-${arch}"
   ln -s "${img}/initrd" "${tmp}/initrd-${arch}"
@@ -21,17 +19,19 @@ build_netboot_image() {
 
 build_kexec_installer() {
   declare -r tag=$1 arch=$2 tmp=$3
-  out=$(nix build --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.kexec-installer-${tag//./}")
+  out=$(nix build --extra-experimental-features 'nix-command flakes' --print-out-paths --option accept-flake-config true -L ".#packages.${arch}.kexec-installer-${tag//./}")
   echo "${out}/nixos-kexec-installer-${arch}.tar.gz"
 }
 
 main() {
-  declare -r tag=${1:-nixos-unstable} arch=${2:-x86_64-linux}
+  declare -r tag=$1
   tmp="$(mktemp -d)"
   trap 'rm -rf -- "$tmp"' EXIT
   (
-    build_kexec_installer "${tag}" "${arch}" "${tmp}"
-    build_netboot_image "${tag}" "${arch}" "${tmp}"
+    for arch in x86_64-linux aarch64-linux; do
+      build_kexec_installer "${tag}" "${arch}" "${tmp}"
+      build_netboot_image "${tag}" "${arch}" "${tmp}"
+    done
   ) | readarray -t assets
   for asset in "${assets[@]}"; do
     pushd "$(dirname "${asset}")"
@@ -40,9 +40,11 @@ main() {
   done
   assets+=("${TMP}/sha256sums")
 
+  cat "${TMP}/sha256sums"
+
   # Since we cannot atomically update a release, we delete the old one before
-  gh release delete "${tag}" </dev/null || true
-  gh release create --title "${tag} (build $(date +"%Y-%m-%d"))" "${tag}" "${assets[@]}" </dev/null
+  #gh release delete "${tag}" </dev/null || true
+  #gh release create --title "${tag} (build $(date +"%Y-%m-%d"))" "${tag}" "${assets[@]}" </dev/null
 }
 
 main "$@"
diff --git a/flake.lock b/flake.lock
index 5c9b000..408469d 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,44 @@
 {
   "nodes": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1678379998,
+        "narHash": "sha256-TZdfNqftHhDuIFwBcN9MUThx5sQXCTeZk9je5byPKRw=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "c13d60b89adea3dc20704c045ec4d50dd964d447",
+        "type": "github"
+      },
+      "original": {
+        "id": "flake-parts",
+        "type": "indirect"
+      }
+    },
+    "hercules-ci-effects": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "hercules-ci-agent": [],
+        "nixpkgs": [
+          "nixos-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1680111600,
+        "narHash": "sha256-qWYXr9gOeU1BaFgZOIDA5tcCWiZTTOVZRHTEl1Znb5w=",
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "rev": "6c1ee352e9c65302969fc510828a98bea38500f6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "hercules-ci-effects",
+        "type": "github"
+      }
+    },
     "nixos-2211": {
       "locked": {
         "lastModified": 1680724564,
@@ -32,8 +71,27 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "dir": "lib",
+        "lastModified": 1678375444,
+        "narHash": "sha256-XIgHfGvjFvZQ8hrkfocanCDxMefc/77rXeHvYdzBMc8=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "130fa0baaa2b93ec45523fdcde942f6844ee9f6e",
+        "type": "github"
+      },
+      "original": {
+        "dir": "lib",
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
+        "hercules-ci-effects": "hercules-ci-effects",
         "nixos-2211": "nixos-2211",
         "nixos-unstable": "nixos-unstable"
       }
diff --git a/flake.nix b/flake.nix
index 01761a6..495c31f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -4,19 +4,45 @@
   inputs.nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
   inputs.nixos-2211.url = "github:NixOS/nixpkgs/release-22.11";
 
+  inputs.hercules-ci-effects.url = "github:hercules-ci/hercules-ci-effects";
+  inputs.hercules-ci-effects.inputs.hercules-ci-agent.follows = "";
+  inputs.hercules-ci-effects.inputs.nixpkgs.follows = "nixos-unstable";
+
   nixConfig.extra-substituters = [
-    "https://cache.garnix.io"
+    "https://nix-community.cachix.org"
   ];
   nixConfig.extra-trusted-public-keys = [
-    "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+    "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
   ];
 
-  outputs = { self, nixos-unstable, nixos-2211 }:
+  outputs = { self, nixos-unstable, nixos-2211, hercules-ci-effects, ... }:
     let
       supportedSystems = [ "aarch64-linux" "x86_64-linux" ];
       forAllSystems = nixos-unstable.lib.genAttrs supportedSystems;
     in
     {
+      effects = { src ? { ref = null; }, ... }:
+        let
+          pkgs = nixos-unstable.legacyPackages.x86_64-linux;
+          hciEffects = hercules-ci-effects.lib.withPkgs pkgs;
+        in
+        {
+          release = hciEffects.runIf (src.ref != "refs/heads/master") (
+            hciEffects.mkEffect {
+              name = "release";
+              inputs = with pkgs; [ bash gh nix ];
+              src = pkgs.lib.cleanSource ./.;
+              secretsMap.githubToken = { type = "GitToken"; };
+              effectScript = ''
+                export GH_TOKEN="$(readSecretString githubToken .token)"
+
+                bash ./build-images.sh nixos-unstable
+                bash ./build-images.sh nixos-21.11
+              '';
+            }
+          );
+        };
+
       packages = forAllSystems (system:
         let
           netboot = nixpkgs: (import (nixpkgs + "/nixos/release.nix") { }).netboot.${system};