diff --git a/.github/workflows/debos.yml b/.github/workflows/debos.yml
index ff787b0a..304a0648 100644
--- a/.github/workflows/debos.yml
+++ b/.github/workflows/debos.yml
@@ -117,7 +117,9 @@ jobs:
       - name: Build flashable files with debos
         run: |
           set -ux
-          debos -t u_boot_rb1:rb1-boot.img \
+          debos \
+              -t u_boot_rb1:rb1-boot.img \
+              -t "buildid:${BUILD_ID}" \
               --print-recipe \
               debos-recipes/qualcomm-linux-debian-flash.yaml
 
@@ -145,10 +147,20 @@ jobs:
               disk-sdcard.img2 \
               flash_qrb2210-*
 
-      - name: Upload private artifacts
+      # upload to a cloud storage space accessible by LAVA and developers
+      - name: Upload private artifacts (GCP)
         uses: qualcomm-linux/upload-private-artifact-action@v1
-        id: upload_artifacts
+        id: upload_artifacts_gcp
+        with:
+          path: debos-artifacts
+
+      # upload to a cloud storage space accessible by Axiom
+      - name: Upload private artifacts (S3)
+        uses: qualcomm-linux/upload-private-artifact-action@aws-v2
         with:
+          s3_bucket: qcom-prd-gh-artifacts
+          # should be the default in that action, or ought to reuse BUILD_ID
+          destination: ${{ github.repository_owner }}/${{ github.event.repository.name }}/${{ github.run_id }}-${{ github.run_attempt }}/
           path: debos-artifacts
 
       - name: Unpack rootfs to generate SBOM
@@ -201,7 +213,7 @@ jobs:
           path: sboms
       - name: "Print output"
         env:
-          build_url: ${{ steps.upload_artifacts.outputs.url }}
+          build_url: ${{ steps.upload_artifacts_gcp.outputs.url }}
         run: |
           echo "Downloads URL: ${build_url}"
           echo "url=\"${build_url}\"" >> $GITHUB_OUTPUT
diff --git a/debos-recipes/qualcomm-linux-debian-flash.yaml b/debos-recipes/qualcomm-linux-debian-flash.yaml
index e57023d0..055561f0 100644
--- a/debos-recipes/qualcomm-linux-debian-flash.yaml
+++ b/debos-recipes/qualcomm-linux-debian-flash.yaml
@@ -6,6 +6,7 @@
 {{- if .u_boot_rb1 -}}
 {{- $build_rb1 = "true" }}
 {{- end -}}
+{{- $buildid := or .buildid "" }}
 
 architecture: arm64
 
@@ -251,6 +252,13 @@ actions:
               "${QCOM_PTOOL}/gen_contents.py" -p ptool-partitions.xml \
                   -t "$contents" \
                   -o contents.xml
+              # XXX insert build_id element before windows_root_path;
+              # this will be nicer to do when gen_contents.py supports
+              # setting this; see also:
+              # https://github.com/qualcomm-linux/qcom-ptool/pull/38
+              sed -i \
+                  "/windows_root_path/ i \t\t\t\t<build_id>{{$buildid}}</build_id>" \
+                  contents.xml
           fi
           # generate flashing files from qcom-partitions.xml
           "${QCOM_PTOOL}/ptool.py" -x ptool-partitions.xml
@@ -263,6 +271,17 @@ actions:
       # copy platform partition files
       cp --preserve=mode,timestamps -v build/ptool/{{ $board.platform }}/* \
           "${flash_dir}"
+      # adjust paths in contents.xml to use board-specific flash_* subdir
+      if [ -e "${flash_dir}/contents.xml" ]; then
+          # one set of backslashes for shell quoting, another one for sed
+          # parsing
+          windows_path=".\\\\flash_{{ $board.name }}\\\\"
+          linux_path="./flash_{{ $board.name }}/"
+          sed -i \
+              -e "s:<windows_root_path>.*:<windows_root_path>${windows_path}</windows_root_path>:" \
+              -e "s:<linux_root_path>.*:<linux_root_path>${linux_path}</linux_root_path>:" \
+              "${flash_dir}/contents.xml"
+      fi
       # remove BLANK_GPT and WIPE_PARTITIONS files as it's common for people
       # to run "qdl rawprogram*.xml", mistakingly including these; perhaps
       # ptool should have a flag not to generate these; note that there are