diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 2592daf1..d10d8657 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -6,6 +6,7 @@ on:
     - cron: '30 6 * * 1'
   # allow manual runs
   workflow_dispatch:
+  push:
 
 # implicitely set all other permissions to none
 permissions:
@@ -28,8 +29,6 @@ concurrency:
 
 jobs:
   build-linux-deb:
-    # don't run cron from forks of the main repository or from other branches
-    if: github.repository == 'qualcomm-linux/qcom-deb-images' && github.ref == 'refs/heads/main'
     # for cross-builds
     runs-on: [self-hosted, qcom-u2404, amd64]
     # alternative for native builds, but overkill to do both
diff --git a/scripts/build-linux-deb.sh b/scripts/build-linux-deb.sh
index 30fae0e5..76c827cf 100755
--- a/scripts/build-linux-deb.sh
+++ b/scripts/build-linux-deb.sh
@@ -9,6 +9,8 @@ GIT_REPO="https://github.com/torvalds/linux"
 GIT_BRANCH="master"
 # base config to use
 CONFIG="defconfig"
+# flavor name
+FLAVOR="upstream"
 
 log_i() {
     echo "I: $*" >&2
@@ -19,71 +21,84 @@ fatal() {
     exit 1
 }
 
-# needed to clone repository
-packages="git"
-# will pull gcc-aarch64-linux-gnu; should pull a native compiler on arm64 and
-# a cross-compiler on other architectures
-packages="${packages} crossbuild-essential-arm64"
-# linux build-dependencies; see linux/scripts/package/mkdebian
-packages="${packages} make flex bison bc libdw-dev libelf-dev libssl-dev"
-packages="${packages} libssl-dev:arm64"
-# linux build-dependencies for debs
-packages="${packages} dpkg-dev debhelper-compat kmod python3 rsync"
-# for nproc
-packages="${packages} coreutils"
+check_dependencies() {
+    # needed to clone repository
+    packages="git"
+    # will pull gcc-aarch64-linux-gnu; should pull a native compiler on arm64
+    # and a cross-compiler on other architectures
+    packages="${packages} crossbuild-essential-arm64"
+    # linux build-dependencies; see linux/scripts/package/mkdebian
+    packages="${packages} make flex bison bc libdw-dev libelf-dev libssl-dev"
+    packages="${packages} libssl-dev:arm64"
+    # linux build-dependencies for debs
+    packages="${packages} dpkg-dev debhelper-compat kmod python3 rsync"
+    # for nproc
+    packages="${packages} coreutils"
 
-log_i "Checking build-dependencies ($packages)"
-missing=""
-for pkg in ${packages}; do
-    # check if package with this name is installed
-    if dpkg -l "${pkg}" 2>&1 | grep -q "^ii  ${pkg}"; then
-        continue
-    fi
-    # otherwise, check if it's a virtual package and if some package providing
-    # it is installed
-    providers="$(apt-cache showpkg "${pkg}" |
-                     sed -e '1,/^Reverse Provides: *$/ d' -e 's/ .*$//' |
-                     sort -u)"
-    provider_found="no"
-    for provider in ${providers}; do
-        if dpkg -l "${provider}" 2>&1 | grep -q "^ii  ${provider}"; then
-            provider_found="yes"
-            break
+    missing=""
+    for pkg in ${packages}; do
+        # check if package with this name is installed
+        if dpkg -l "${pkg}" 2>&1 | grep -q "^ii  ${pkg}"; then
+            continue
+        fi
+        # otherwise, check if it's a virtual package and if some package
+        # providing it is installed
+        providers="$(apt-cache showpkg "${pkg}" |
+                         sed -e '1,/^Reverse Provides: *$/ d' -e 's/ .*$//' |
+                         sort -u)"
+        provider_found="no"
+        for provider in ${providers}; do
+            if dpkg -l "${provider}" 2>&1 | grep -q "^ii  ${provider}"; then
+                provider_found="yes"
+                break
+            fi
+        done
+        if [ "${provider_found}" = yes ]; then
+            continue
         fi
+        missing="${missing} ${pkg}"
     done
-    if [ "${provider_found}" = yes ]; then
-        continue
+    if [ -n "${missing}" ]; then
+        fatal "Missing build-dependencies: ${missing}"
     fi
-    missing="${missing} ${pkg}"
-done
-if [ -n "${missing}" ]; then
-    fatal "Missing build-dependencies: ${missing}"
-fi
+}
 
-log_i "Cloning Linux (${GIT_REPO}:${GIT_BRANCH})"
-git clone --depth=1 --branch "${GIT_BRANCH}" "${GIT_REPO}" linux
+get_kernel() {
+    git clone --depth=1 --branch "${GIT_BRANCH}" "${GIT_REPO}" linux
+}
+
+configure_kernel() {
+    rm -vf linux/kernel/configs/local.config
+    for fragment in "$@"; do
+        log_i "Adding config fragment to local.config: ${fragment}"
+        touch linux/kernel/configs/local.config
+        cat "$fragment" >>linux/kernel/configs/local.config
+    done
+
+    if [ -r kernel/configs/local.config ]; then
+        make -C linux ARCH=arm64 "${CONFIG}" local.config
+    else
+        make -C linux ARCH=arm64 "${CONFIG}"
+    fi
+}
+
+build_kernel() {
+    echo "-${FLAVOR}" >localversion
+    make "-j$(nproc)" \
+        ARCH=arm64 DEB_HOST_ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- \
+        KDEB_SOURCENAME="linux-${FLAVOR}" \
+        deb-pkg
+}
 
-log_i "Configuring Linux (base config: ${CONFIG})"
-rm -vf linux/kernel/configs/local.config
-for fragment in "$@"; do
-    log_i "Adding config fragment to local.config: ${fragment}"
-    touch linux/kernel/configs/local.config
-    cat "$fragment" >>linux/kernel/configs/local.config
-done
+log_i "Checking build-dependencies"
+check_dependencies
 
-# only change working directory after having read config fragments passed on
-# the command-line as these might be relative pathnames
-cd linux
+log_i "Getting Linux from repo ${GIT_REPO} and branch ${GIT_BRANCH}"
+get_kernel
 
-if [ -r kernel/configs/local.config ]; then
-    make ARCH=arm64 "${CONFIG}" local.config
-else
-    make ARCH=arm64 "${CONFIG}"
-fi
+log_i "Configuring Linux with base config ${CONFIG} and config fragments $*"
+configure_kernel "$@"
 
 log_i "Building Linux deb"
-# TODO: build other packages?
-make "-j$(nproc)" \
-    ARCH=arm64 DEB_HOST_ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- \
-    bindeb-pkg
+build_kernel