diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 2d381ce..589a5cc 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,25 +1,36 @@
 name: build
 
 on:
-  # TODO: Enable once we have conditional build logic built
-  # pull_request:
-  #   paths:
-  #     - 'srcpkgs/**'
+  # a package changed (usually in PR)
+  workflow_run:
+    workflows: [ChecksumUpdate]
+    types: [completed]
+  # we are integrating updates
   push:
     paths:
-      - 'srcpkgs/**'
+      - "srcpkgs/**"
+    branches:
+      - main
 
 jobs:
   changedpkgs:
     name: Check package changes
     runs-on: ubuntu-latest
-    if: "!contains(github.event.pull_request.title, '[ci skip]') && !contains(github.event.pull_request.body, '[ci skip]')"
+    if: "${{ github.event.workflow_run.conclusion == 'success' }} && !contains(github.event.pull_request.title, '[ci skip]') && !contains(github.event.pull_request.body, '[ci skip]')"
 
     outputs:
       changed: ${{ steps.grabchanged.outputs.changed }}
 
     steps:
+      - name: checkout local templates from prev workflow
+        if: "${{ github.event_name == 'workflow_run' }}"
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.workflow_run.head_branch }}
+
       - name: checkout local templates
+        if: "${{ github.event_name != 'workflow_run' }}"
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
@@ -36,14 +47,20 @@ jobs:
   build:
     name: Build packages
     runs-on: ubuntu-latest
-    needs: [ changedpkgs ]
+    needs: [changedpkgs]
     if: "needs.changedpkgs.outputs.changed != '' && !contains(github.event.pull_request.title, '[ci skip]') && !contains(github.event.pull_request.body, '[ci skip]')"
 
     strategy:
       fail-fast: false
       matrix:
         config:
-          - { arch: x86_64,       host: x86_64,      libc: glibc, platform: linux/amd64, test: 1 }
+          - {
+              arch: x86_64,
+              host: x86_64,
+              libc: glibc,
+              platform: linux/amd64,
+              test: 1,
+            }
           # - { arch: i686,         host: i686,        libc: glibc, platform: linux/386,   test: 1 }
           # - { arch: aarch64,      host: x86_64,      libc: glibc, platform: linux/amd64, test: 0 }
           # - { arch: armv7l,       host: x86_64,      libc: glibc, platform: linux/amd64, test: 0 }
@@ -52,14 +69,14 @@ jobs:
           # - { arch: aarch64-musl, host: x86_64-musl, libc: musl,  platform: linux/amd64, test: 0 }
 
     container:
-      image: ghcr.io/void-linux/void-${{ matrix.config.libc }}-full:20250227R1
+      image: ghcr.io/void-linux/void-${{ matrix.config.libc }}-full:latest
       options: --platform ${{ matrix.config.platform }} --privileged
       volumes:
         - /dev:/dev
       env:
-        ARCH: '${{ matrix.config.arch }}'
-        BOOTSTRAP: '${{ matrix.config.host }}'
-        TEST: '${{ matrix.config.test }}'
+        ARCH: "${{ matrix.config.arch }}"
+        BOOTSTRAP: "${{ matrix.config.host }}"
+        TEST: "${{ matrix.config.test }}"
 
     steps:
       - name: Prepare container
@@ -99,7 +116,7 @@ jobs:
       - name: Find changed templates
         env:
           CHANGED: ${{ needs.changedpkgs.outputs.changed }}
-        run: sudo -Eu builder echo "$CHANGED" | sed 's/ /\n/g' > /tmp/templates
+        run: sudo -Eu builder echo "${{ env.CHANGED }}" | sed 's/ /\n/g' > /tmp/templates
 
       - name: Build and check packages
         run: sudo -Eu builder common/travis/build.sh "$BOOTSTRAP" "$ARCH" "$TEST"
@@ -109,8 +126,10 @@ jobs:
 
       - name: Archive xbps artifacts
         uses: actions/upload-artifact@v4
+        env:
+          CHANGED: ${{ needs.changedpkgs.outputs.changed }}
         with:
-          name: binaries-${{ matrix.config.arch }}-${{ matrix.config.libc }}
+          name: binaries-${{ env.CHANGED }}-${{ matrix.config.arch }}-${{ matrix.config.libc }}.xbps
           path: |
             hostdir/binpkgs/*.xbps
 
@@ -135,14 +154,14 @@ jobs:
   deploy:
     name: Deploy repository
     runs-on: ubuntu-latest
-    needs: [ build ]
+    needs: [build]
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}-deployment
       cancel-in-progress: false
-    if: "github.ref == 'refs/heads/main' && !contains(github.event.pull_request.title, '[ci skip]') && !contains(github.event.pull_request.body, '[ci skip]')"
+    if: "github.ref == 'refs/heads/main' && github.event_name != 'workflow_run' && !contains(github.event.pull_request.title, '[ci skip]') && !contains(github.event.pull_request.body, '[ci skip]')"
 
     container:
-      image: ghcr.io/void-linux/void-glibc-full:20250227R1
+      image: ghcr.io/void-linux/void-glibc-full:latest
       options: --privileged
 
     steps:
@@ -182,6 +201,13 @@ jobs:
         run: |
           xbps-rindex --add $PWD/*.xbps
           xbps-rindex --clean $PWD
+          xbps-rindex --remove $PWD
+
+      - name: Commit new repo state
+        uses: stefanzweifel/git-auto-commit-action@v6
+        with:
+          file_pattern: "*.xbps *.xbps.sig2"
+          commit_message: "Update package repo"
 
       # - name: checksum
       #   run: |
diff --git a/.github/workflows/checksum.yaml b/.github/workflows/checksum.yaml
new file mode 100644
index 0000000..fc0614f
--- /dev/null
+++ b/.github/workflows/checksum.yaml
@@ -0,0 +1,79 @@
+name: ChecksumUpdate
+
+on:
+  pull_request:
+    paths:
+      - "srcpkgs/**"
+    types:
+      - opened
+      - synchronize
+    branches:
+      - main
+
+jobs:
+  checksum:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/void-linux/void-glibc-full:latest
+      options: --platform linux/amd64 --privileged
+      volumes:
+        - /dev:/dev
+      env:
+        ARCH: x86_64
+        BOOTSTRAP: x86_64
+        TEST: 1
+
+    steps:
+      - name: Prepare container
+        run: |
+          # switch to repo-ci mirror
+          mkdir -p /etc/xbps.d && cp /usr/share/xbps.d/*-repository-*.conf /etc/xbps.d/
+          sed -i 's|repo-default|repo-ci|g' /etc/xbps.d/*-repository-*.conf
+          # install dependencies
+          xbps-install -Suy xbps && xbps-install -Suy sudo xtools bash git
+          # create non-root user
+          useradd -G xbuilder -M builder
+
+      - name: checkout local templates
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: ${{ github.ref }}
+
+      - name: remember changed package
+        run: |
+          git config --global --add safe.directory $PWD
+          echo "CHANGED_PKG=$(git diff --name-only origin/main origin/${GITHUB_HEAD_REF} "srcpkgs/*/template" | head -1 | cut -d/ -f2)" >> $GITHUB_ENV
+          echo "CHANGED: ${{ env.CHANGED_PKG }}"
+
+      - name: checkout upstream templates
+        uses: actions/checkout@v4
+        with:
+          repository: void-linux/void-packages
+          ref: master
+          fetch-depth: 1
+          path: upstream
+
+      - name: prep masterdir
+        working-directory: upstream
+        run: |
+          chown -R builder:builder . &&
+          sudo -Eu builder common/travis/set_mirror.sh &&
+          sudo -Eu builder common/travis/prepare.sh
+
+      - name: copy to upstream
+        run: cp -rv srcpkgs/* upstream/srcpkgs
+
+      - name: generate checksum
+        working-directory: upstream
+        run: "sudo -Eu builder xgensum -f -i ${{ env.CHANGED_PKG }}"
+
+      - name: receive relevant copy from upstream
+        run: |
+          cp -r "upstream/srcpkgs/${{ env.CHANGED_PKG }}" srcpkgs
+
+      - name: commit new checksum
+        uses: stefanzweifel/git-auto-commit-action@v6
+        with:
+          file_pattern: "srcpkgs/${{ env.CHANGED_PKG }}/template"
+          commit_message: "Update ${{ env.CHANGED_PKG }} checksum"
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 9cf2fd9..54fbe14 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -1,15 +1,12 @@
-name: renovate
+name: Check package updates
 on:
   schedule:
-    - cron: '0 * * * *'
-  push:
-    paths:
-      - '.github/**' # TODO: remove after debugging
+    - cron: "0 * * * *"
 
 env:
-  LOG_LEVEL: 'debug'
+  LOG_LEVEL: "info"
   RENOVATE_AUTODISCOVER: true
-  RENOVATE_AUTODISCOVER_FILTER: '${{ github.repository }}'
+  RENOVATE_AUTODISCOVER_FILTER: "${{ github.repository }}"
   RENOVATE_PLATFORM: github
   # RENOVATE_PLATFORM_COMMIT: true
   # RENOVATE_BOT_NAME: 'breq'
@@ -26,10 +23,3 @@ jobs:
         with:
           configurationFile: .github/renovate.json
           token: ${{ secrets.RENOVATE_TOKEN }}
-
-
-      - name: Find updated package
-        run: |
-          #!/usr/bin/env bash
-          set -euxo pipefail
-          echo "pkgbuild=$(git diff --name-only origin/main origin/${GITHUB_HEAD_REF} "*template" | head -1 | xargs dirname)" >> $GITHUB_ENV
diff --git a/srcpkgs/ripgrep-all/template b/srcpkgs/ripgrep-all/template
index 2f435c4..c5eec16 100644
--- a/srcpkgs/ripgrep-all/template
+++ b/srcpkgs/ripgrep-all/template
@@ -1,6 +1,6 @@
 # Template file for 'ripgrep-all'
 pkgname=ripgrep-all
-version=0.10.6 # renovate: datasource=github-tags depName=phiresky/ripgrep-all
+version=0.10.9 # renovate: datasource=github-tags depName=phiresky/ripgrep-all
 revision=2
 build_style=cargo
 hostmakedepends="rust pkg-config"
@@ -13,7 +13,7 @@ maintainer="Marty Oehme <contact@martyoeh.me>"
 license="AGPL-3.0-only"
 homepage="https://github.com/phiresky/ripgrep-all"
 distfiles="${homepage}/archive/v${version}.tar.gz"
-checksum=06cd619ad6638be206266a77fdf11034dc2dc15d97b3a057b0d6280a17334680
+checksum=a5b3150940dcddd35a26e9de398f11a563d0466a335e5450ceb7ff369e9fef45
 
 post_install() {
     vdoc  README.md