diff --git a/Justfile b/Justfile
index 34caf21d2..10df101c7 100644
--- a/Justfile
+++ b/Justfile
@@ -1,16 +1,19 @@
+[private]
 default:
     #!/usr/bin/env bash
     set -xeuo pipefail
     just --choose
 
 _do-release stream:
-    #!/usr/bin/env bash
-    sudo rm -rf mkosi.output/ && \
+    sudo bash -c ' \
+    just genkey && \
+    rm -rf mkosi.output/ && \
     just mkosi -B --debug --profile={{stream}} --force --workspace-directory=/workspace && \
-    sudo PROFILE={{stream}} ./assemble-iso.sh
-    sudo just compress-repo
-    sudo chown -R "$(id -u):$(id -g)" mkosi.output
-    sudo chmod -R u+rwX mkosi.output
+    PROFILE={{stream}} ./assemble-iso.sh && \
+    just compress-repo && \
+    chown -R "$SUDO_UID:$SUDO_GID" mkosi.output && \
+    chmod -R u+rwX mkosi.output \
+    '
 
 # Built every day from the main branch
 do-daily: (_do-release "daily")
@@ -29,14 +32,16 @@ _get_timestamp:
     set -euo pipefail
     echo "$(cat ./mkosi.version)"
 
+[private]
 genkey:
-    just mkosi genkey
+    just mkosi genkey --force
 
+[private]
 mkosi +subcommand:
-    mkdir -p {{env_var('HOME')}}/.cache/mkosi-workspace
-    sudo mkdir -p ~/.cache/mkosi
+    mkdir -p ~/.cache/mkosi-workspace
+    mkdir -p ~/.cache/mkosi
 
-    sudo podman run --rm \
+    podman run --rm \
         --network host \
         --dns 8.8.8.8 \
         --privileged \
@@ -45,16 +50,19 @@ mkosi +subcommand:
         -v /dev:/dev \
         -v "{{invocation_directory()}}:/work" \
         -w /work \
-        -v "{{env_var('HOME')}}/.cache/mkosi-workspace:/workspace" \
+        -v ~/.cache/mkosi-workspace:/workspace \
         ghcr.io/elementary/mkosi:tanit \
         mkosi {{subcommand}}
 
 
 
 clean:
-    just mkosi clean
-    sudo rm -r mkosi.tools/ mkosi.cache/ ~/.cache/mkosi/*
+    sudo bash -c ' \
+    just mkosi clean && \
+    rm -rf mkosi.tools mkosi.cache mkosi.output ~/.cache/mkosi ~/.cache/mkosi-workspace \
+    '
 
+[private]
 compress-repo:
     #!/usr/bin/env bash
     set -euo pipefail
@@ -70,22 +78,23 @@ compress-repo:
     zstd -T0 --rm -f "${files[@]}"
     ls -l "${files[@]/%/.zst}"
 
+[private]
 checksum-repo:
-    #!/usr/bin/env bash
-    set -euo pipefail
-    cd mkosi.output
+    cd mkosi.output && \
     sha256sum elementary_*.efi \
         elementary_*.usr-*.*.raw.zst \
-        > SHA256SUMS
+        > SHA256SUMS && \
     cat SHA256SUMS
 
+[private]
 checksum-ext:
-    #!/usr/bin/env bash
-    cd mkosi.output
-    mkdir ext
-    mv {ext,driver}-*.raw.zst ext/
-    mv *addon.efi ext/
-    cd ext/
-    sha256sum {ext,driver}-*.raw.zst > SHA256SUMS
-    sha256sum *addon.efi >> SHA256SUMS
+    cd mkosi.output && \
+    mkdir -p ext && \
+    mv ext-*.raw.zst ext/ || true && \
+    mv driver-*.raw.zst ext/ || true && \
+    mv *addon.efi ext/ || true && \
+    cd ext/ && \
+    sha256sum ext-*.raw.zst > SHA256SUMS && \
+    sha256sum driver-*.raw.zst >> SHA256SUMS && \
+    sha256sum *addon.efi >> SHA256SUMS && \
     cat SHA256SUMS
diff --git a/README.md b/README.md
index a8b9f5df0..e434c0ba6 100644
--- a/README.md
+++ b/README.md
@@ -28,12 +28,12 @@ You'll need the following runtime dependencies:
 * podman
 * just
 * zstd
+* fzf
 * systemd
 
-Generate keys and then build with `just`
+Build the OS artifacts (ISO etc.) with `just`
 
 ```bash
-just genkey
 just do-daily
 ```
 Create install media with [Fedora Media Writer](https://flathub.org/en/apps/org.fedoraproject.MediaWriter) or [Impression](flathub.org/en/apps/io.gitlab.adhami3310.Impression), or boot with GNOME Boxes (>=51).
diff --git a/assemble-iso.sh b/assemble-iso.sh
index 3a4e93407..79dd85370 100755
--- a/assemble-iso.sh
+++ b/assemble-iso.sh
@@ -52,7 +52,7 @@ echo "Creating casper liveiso..."
 
 mkdir -p iso_root/extra
 
-sudo podman run --rm -it \
+podman run --rm -it \
 --network host \
 --dns 8.8.8.8 \
 -v "$(pwd)":/workspace:Z \