diff --git a/board/czechlight/clearfog/copy-boot-scr.sh b/board/czechlight/clearfog/copy-boot-scr.sh
index 88508a4..cf32479 100755
--- a/board/czechlight/clearfog/copy-boot-scr.sh
+++ b/board/czechlight/clearfog/copy-boot-scr.sh
@@ -1,6 +1,7 @@
 #!/bin/sh
 
 install -m 0644 -D $BINARIES_DIR/boot.scr $TARGET_DIR/boot/boot.scr
+install -m 0644 -D $BINARIES_DIR/u-boot-spl.kwb $TARGET_DIR/usr/libexec/u-boot-spl.kwb
 
 # Prepare a boot script for USB booting as well
 ${HOST_DIR}/bin/mkimage -C none -A arm -T script \
diff --git a/board/czechlight/clearfog/overlay/usr/bin/reflash-uboot b/board/czechlight/clearfog/overlay/usr/bin/reflash-uboot
new file mode 100755
index 0000000..f91904d
--- /dev/null
+++ b/board/czechlight/clearfog/overlay/usr/bin/reflash-uboot
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -ex
+
+if [[ "$1" != "--yes-this-is-dangerous" ]]; then
+    echo "Refusing to continue, re-run with the --yes-this-is-dangerous option to proceed"
+    exit 1
+fi
+
+echo 0 > /sys/block/mmcblk0boot0/force_ro
+echo 0 > /sys/block/mmcblk0boot1/force_ro
+ddrescue --force /usr/libexec/u-boot-spl.kwb /dev/mmcblk0boot0
+ddrescue --force /usr/libexec/u-boot-spl.kwb /dev/mmcblk0boot1
+dd if=/usr/libexec/u-boot-spl.kwb of=/dev/mmcblk0 bs=512 seek=1
+sync
+echo 1 > /sys/block/mmcblk0boot1/force_ro
+echo 1 > /sys/block/mmcblk0boot0/force_ro
diff --git a/ci/build.sh b/ci/build.sh
index 3f6dea2..3577561 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -92,8 +92,6 @@
 
 if [[ "${ZUUL_JOB_NAME}" =~ clearfog ]]; then
     if [[ ${TRIGGERED_VIA_DEP} != 1 ]]; then
-        mv images/u-boot-spl.kwb ~/zuul-output/artifacts/
-
         # store a cached tarball as an artifact
         ARTIFACT=br2-work-dir-${BR2_EXTERNAL_COMMIT}.tar.zst
         # everything but local.mk which we might have adjusted in job prologue, so let's not overwrite that