diff --git a/.github/workflows/build-iso.yml b/.github/workflows/build-iso.yml
index ad2f397..87b1080 100644
--- a/.github/workflows/build-iso.yml
+++ b/.github/workflows/build-iso.yml
@@ -165,15 +165,28 @@ jobs:
             sha256sum "$ISO_NAME" > "$ISO_NAME.sha256"
             ls -lh "$ISO_NAME"
 
-      - name: Upload ISO artifact
-        if: success()
-        uses: actions/upload-artifact@v4
+      # ── ISO publish ────────────────────────────────────────────────────
+      # Use GitHub Releases (not Actions artifacts) for ISO storage.
+      # Reason: artifact quota maxed at 50GB on Pro tier with ~18 ISOs.
+      # Releases have effectively unlimited storage per public/private repo.
+      # On every successful build of main, update the rolling `ci-latest`
+      # prerelease draft. Tag releases (`v*.*.*`) get a separate proper
+      # release. Build logs stay as artifacts (they're tiny + opt-in only
+      # on failure).
+      - name: Publish ISO to ci-latest rolling prerelease
+        if: success() && github.ref == 'refs/heads/main'
+        uses: softprops/action-gh-release@v2
         with:
-          name: veilor-os-iso
-          path: |
+          tag_name: ci-latest
+          name: "ci-latest (auto)"
+          body: |
+            Rolling auto-build from `main`. Latest commit: ${{ github.sha }}.
+            Replaces on every push. Not a stable release — for testing only.
+          prerelease: true
+          make_latest: false
+          files: |
             build/out/*.iso
             build/out/*.sha256
-          retention-days: 3
 
       - name: Upload build log on failure
         if: failure()
@@ -183,8 +196,9 @@ jobs:
           path: |
             build/out/build.log
             build/out/build/anaconda/
+          retention-days: 1
 
-      - name: Attach to release
+      - name: Attach to release on tag
         if: github.event_name == 'release'
         uses: softprops/action-gh-release@v2
         with: