diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1d5e93e..d7f8b55 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -13,7 +13,9 @@ name: Publish apt index
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - 'ci/**'      # let bootstrap / preview branches exercise the pipeline
     paths:
       - 'incoming/**'
       - 'pool/**'
@@ -169,7 +171,7 @@ jobs:
       - name: Clean pool/ before committing (we don't want .deb in git)
         run: rm -rf pool/main/*.deb
 
-      - name: Commit metadata back to main
+      - name: Commit metadata back to the source branch
         run: |
           set -euo pipefail
           git config user.name "cardputer-repo-bot"
@@ -180,21 +182,30 @@ jobs:
               exit 0
           fi
           git commit -m "ci: refresh apt index ($(date -u +%Y-%m-%dT%H:%M:%SZ))"
-          git push origin HEAD:main
+          # Push back to whichever branch triggered us (main or a ci/** preview).
+          git push origin HEAD:"${GITHUB_REF#refs/heads/}"
 
-      - name: Publish to gh-pages
+      - name: Publish to gh-pages (or gh-pages-preview on ci/** branches)
         run: |
           set -euo pipefail
+          # ci/** branches push to a preview branch so they never overwrite
+          # the production index. main writes straight to gh-pages.
+          case "${GITHUB_REF#refs/heads/}" in
+              main) pages_branch=gh-pages ;;
+              *)    pages_branch=gh-pages-preview ;;
+          esac
+          echo "→ target branch: $pages_branch"
+
           staging=$(mktemp -d)
           cp -r dists "$staging/"
           [ -f KEY.gpg ] && cp KEY.gpg "$staging/"
           cp README.md "$staging/index.md"
 
           cd "$staging"
-          git init -q -b gh-pages
+          git init -q -b "$pages_branch"
           git config user.name "cardputer-repo-bot"
           git config user.email "bot@users.noreply.github.com"
           git remote add origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
           git add -A
-          git commit -q -m "publish apt index"
-          git push -qf origin gh-pages
+          git commit -q -m "publish apt index ($pages_branch)"
+          git push -qf origin "$pages_branch"
diff --git a/dists/stable/Release b/dists/stable/Release
new file mode 100644
index 0000000..b54a444
--- /dev/null
+++ b/dists/stable/Release
@@ -0,0 +1,23 @@
+Architectures: arm64
+Codename: stable
+Components: main
+Date: Wed, 06 May 2026 07:10:23 +0000
+Label: CardputerZero
+Origin: CardputerZero
+Suite: stable
+MD5Sum:
+ 4e2aa46ed33d6756058bf8b05fb1a898              150 Release
+ 7f68f295bcc2c4f1991bb802ee31e32f              688 main/binary-arm64/Packages
+ ba6b8981a576ebf97880e2e188f16e8a              508 main/binary-arm64/Packages.gz
+SHA1:
+ a4d557e81d104df2b8dd1211969efde28ae32fcf              150 Release
+ 2082c8d1efc6ca14a4577ad683fae1225bb1c3d8              688 main/binary-arm64/Packages
+ ccb67757ca3cc30d42ca2f7dfb93dd49db849d41              508 main/binary-arm64/Packages.gz
+SHA256:
+ bd21c7b914649ee5e2bd71e113517f701e074a941128837f40685b99eb886c10              150 Release
+ cbda207ebf7a61f7f8cb9d8821b2d642f6c0dee3ac3dedb0f11f8a548c8806c1              688 main/binary-arm64/Packages
+ 26f4db77260017a2f82a6b2ea54055ebee773e695cbc3c58c9614320c199dfa3              508 main/binary-arm64/Packages.gz
+SHA512:
+ 0ee5e2859e93a8f6e968829c7be3069c17e9e90ad85c54242d04771b5d79aaac9677647669281f57142f39c249993e0f415ace66b8f1f86ba081aa01719ac224              150 Release
+ 00373c6151cf570529147e3ab8a75c68239c9957963cae624ef13618f36de1b90b1af8b73d94f03336bb242f3aa4d57f06d65bd023bc8cc4a0f0fdea2c1d9fd2              688 main/binary-arm64/Packages
+ c64016278c9229f742927411335d1c8d5effd53ad74ee73877280e92977d3b63984fa40886fba3281f594d2ea8e7feb29d49bb7ead93bf1ee79c9d9b12ba5f1f              508 main/binary-arm64/Packages.gz
diff --git a/dists/stable/main/binary-arm64/Packages b/dists/stable/main/binary-arm64/Packages
new file mode 100644
index 0000000..554c22e
--- /dev/null
+++ b/dists/stable/main/binary-arm64/Packages
@@ -0,0 +1,14 @@
+Package: czrepo-hello
+Architecture: arm64
+Version: 0.1-1
+Maintainer: CardputerZero Repository <repo@m5stack.local>
+Filename: releases/download/apt-pool/czrepo-hello_0.1-1_arm64.deb
+Size: 784
+MD5sum: a4703c66a80bea45d9c45377ed6f235d
+SHA1: c3e62927584e90fb0265fd1282ac86058b45a640
+SHA256: dd80f7e4437219469afde60ecb79c80532d19e7ff1746270d322410415efcef3
+SHA512: f847524840b716e56363774663da65cd349235d08e6537cc1a02bacfa1c0d8bc542a2b8399a879bd63f6cd3f58154a025f9a7ccb9461d931d0a57fbb6b31bb9c
+Description: Bootstrap sentinel package used to validate publish.yml.
+ Ships a single file with a greeting; safe to dpkg -i on any arm64 host
+ because it only writes under /usr/share/czrepo-hello/.
+
diff --git a/dists/stable/main/binary-arm64/Packages.gz b/dists/stable/main/binary-arm64/Packages.gz
new file mode 100644
index 0000000..1d44647
Binary files /dev/null and b/dists/stable/main/binary-arm64/Packages.gz differ
diff --git a/incoming/czrepo-hello_0.1-1_arm64.deb b/incoming/czrepo-hello_0.1-1_arm64.deb
deleted file mode 100644
index e2648aa..0000000
Binary files a/incoming/czrepo-hello_0.1-1_arm64.deb and /dev/null differ