diff --git a/.zuul.yaml b/.zuul.yaml
index 0b5bc96..208ce46 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -2,6 +2,7 @@
     name: czechlight-clearfog
     parent: run-ci-build-sh-f31
     timeout: 3600
+    post-timeout: 600
     vars:
       prepare_git_submodules: true
       zuul_work_dir: "{{ zuul.projects['cesnet-gerrit-czechlight/CzechLight/br2-external'].src_dir }}"
@@ -35,5 +36,17 @@
 - project:
     check:
       jobs:
-        - czechlight-clearfog
+        - czechlight-clearfog:
+            provides: CzechLight-br2-build-clearfog
+            vars:
+              artifacts:
+                name: br2-work-dir
+                glob: 'br2-work-dir-*.tar.zst'
+            post-run: ci/post.yaml
+            roles:
+              - zuul: return-built-artifact
         - czechlight-beagleboneblack
+
+    promote:
+      jobs:
+        - promote-artifacts
diff --git a/ci/build.sh b/ci/build.sh
index 94b9d01..20b203f 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -15,8 +15,15 @@
 # Dependencies are normally specified via the cla-sysrepo.git repo
 ${ZUUL_PROJECT_SRC_DIR}/dev-setup-git.sh
 
-# If we're being triggered via a change against another repo, use speculatively merged stuff from Zuul, not our submodules
 if [[ $(jq < ~/zuul-env.json -r '.project.name') != 'CzechLight/br2-external' ]]; then
+    TRIGGERED_VIA_DEP=1
+else
+    TRIGGERED_VIA_DEP=0
+fi
+BR2_EXTERNAL_COMMIT=$(git --git-dir ${ZUUL_PROJECT_SRC_DIR}/.git rev-parse HEAD)
+
+# If we're being triggered via a change against another repo, use speculatively merged stuff from Zuul, not our submodules
+if [[ ${TRIGGERED_VIA_DEP} == 1 ]]; then
     # C++ dependencies can be provided either via cla-sysrepo, or via netconf-cli.
     # Whatever is the latest change in the queue wins.
     USE_DEPENDENCIES_VIA=$(jq < ~/zuul-env.json -r '[.items[]? | select(.project.name == "CzechLight/cla-sysrepo" or .project.name == "CzechLight/netconf-cli")][-1]?.project.src_dir + ""')
@@ -58,7 +65,26 @@
 mv images/update.raucb ~/zuul-output/artifacts/
 
 if [[ "${ZUUL_JOB_NAME}" =~ clearfog ]]; then
-    mv images/u-boot-spl.kwb ~/zuul-output/artifacts/
+    if [[ ${TRIGGERED_VIA_DEP} != 1 ]]; then
+        mv images/u-boot-spl.kwb ~/zuul-output/artifacts/
+
+        # store a cached tarball as an artifact
+        ARTIFACT=br2-work-dir-${BR2_EXTERNAL_COMMIT}.tar.zst
+        # everything but local.mk which we might have adjusted in job prologue, so let's not overwrite that
+        tar --totals -c \
+            --exclude='images/rootfs.*' \
+            --exclude='images/sdcard.*' \
+            --exclude='images/usb-flash.*' \
+            .br* \
+            build \
+            .config \
+            host \
+            images \
+            Makefile \
+            per-package \
+            target \
+            | zstd -T0 > ~/zuul-output/artifacts/${ARTIFACT}
+    fi
 fi
 
 # TODO: USB image as well? (`fallocate -d` to make it sparse)
diff --git a/ci/post.yaml b/ci/post.yaml
new file mode 100644
index 0000000..c354465
--- /dev/null
+++ b/ci/post.yaml
@@ -0,0 +1,3 @@
+- hosts: all
+  roles:
+    - return-built-artifact