diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index 87b1080..c264234 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -19,6 +19,9 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: write   # needed for action-gh-release to create+update ci-latest
+
 jobs:
   build:
     name: Build live ISO
@@ -188,15 +191,15 @@ jobs:
             build/out/*.iso
             build/out/*.sha256
 
-      - name: Upload build log on failure
+      # Build log on failure: print inline + skip artifact upload to avoid
+      # quota wall. Job log retains everything anyway.
+      - name: Print build log on failure
         if: failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: veilor-os-buildlog
-          path: |
-            build/out/build.log
-            build/out/build/anaconda/
-          retention-days: 1
+        run: |
+          echo "─── build/out/build.log ───"
+          tail -200 build/out/build.log 2>/dev/null || echo "(no build.log)"
+          echo "─── anaconda program.log ───"
+          find build/out/build/anaconda -name 'program.log' -exec tail -100 {} \; 2>/dev/null || echo "(no anaconda log)"
 
       - name: Attach to release on tag
         if: github.event_name == 'release'