diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1589c0877..cf197b17d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -536,9 +536,9 @@ jobs:
 
       - name: Get token
         id: token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.WORKFLOW_DISPATCHER_ID }}
+          client-id: ${{ vars.WORKFLOW_DISPATCHER_ID }}
           private-key: ${{ secrets.WORKFLOW_DISPATCHER_KEY }}
           owner: ${{ vars.PAGES_REPO_OWNER }}
           repositories: ${{ vars.PAGES_REPO_NAME }}
diff --git a/build-mac.sh b/build-mac.sh
index 99e52efbd..b7dca9ef7 100755
--- a/build-mac.sh
+++ b/build-mac.sh
@@ -2,78 +2,80 @@
 # =============================================================================
 # Mac-specific iPXE build shortcut
 #
-# Builds both the native tg3 EFI binary and an SNP fallback, with the
-# boot.ipxe script embedded in each.  Outputs to ./build/.
+# Builds the native tg3 EFI binary and an SNP fallback, packages each into
+# a bootable FAT32 .img with autoexec.ipxe alongside the EFI binary.
 #
 # Usage:
-#   ./build-mac.sh [--embed <script>]
+#   ./build-mac.sh [OPTIONS]
 #
 # Options:
-#   -e, --embed <file>   Boot script to embed (default: boot.ipxe if it exists)
-#   -j, --jobs  <n>      Parallel jobs (default: nproc)
+#   -s, --script <file>   autoexec script (default: boot.ipxe if present)
+#   -j, --jobs   <n>      Parallel jobs (default: nproc)
 #   -h, --help
 # =============================================================================
 set -euo pipefail
 
 SCRIPT_DIR="$(dirname "$0")"
 JOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)"
-EMBED=""
+SCRIPT=""
 
-# ── Colour helpers ────────────────────────────────────────────────────────────
+# ── Colour helpers ─────────────────────────────────────────────────────────────
 if [ -t 1 ]; then
     C_BOLD='\033[1m'; C_GREEN='\033[0;32m'; C_CYAN='\033[0;36m'
-    C_YELLOW='\033[0;33m'; C_RED='\033[0;31m'; C_RESET='\033[0m'
+    C_RED='\033[0;31m'; C_RESET='\033[0m'
 else
-    C_BOLD=''; C_GREEN=''; C_CYAN=''; C_YELLOW=''; C_RED=''; C_RESET=''
+    C_BOLD=''; C_GREEN=''; C_CYAN=''; C_RED=''; C_RESET=''
 fi
-info()  { echo -e "${C_CYAN}▶${C_RESET} $*"; }
-ok()    { echo -e "${C_GREEN}✔${C_RESET} $*"; }
-die()   { echo -e "${C_RED}✘${C_RESET} $*" >&2; exit 1; }
+info() { echo -e "${C_CYAN}▶${C_RESET} $*"; }
+ok()   { echo -e "${C_GREEN}✔${C_RESET} $*"; }
+die()  { echo -e "${C_RED}✘${C_RESET} $*" >&2; exit 1; }
 
 while [[ $# -gt 0 ]]; do
     case $1 in
-        -e|--embed) EMBED="$2"; shift 2 ;;
-        -j|--jobs)  JOBS="$2";  shift 2 ;;
-        -h|--help)  sed -n '3,12p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+        -s|--script) SCRIPT="$2"; shift 2 ;;
+        -j|--jobs)   JOBS="$2";   shift 2 ;;
+        -h|--help)   sed -n '3,13p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
         *) die "Unknown option: $1" ;;
     esac
 done
 
-# Default embed: boot.ipxe in repo root if present
-if [[ -z "$EMBED" && -f "$SCRIPT_DIR/boot.ipxe" ]]; then
-    EMBED="$SCRIPT_DIR/boot.ipxe"
-    info "Auto-detected embed script: $EMBED"
+# Auto-detect boot.ipxe in repo root
+if [[ -z "$SCRIPT" && -f "$SCRIPT_DIR/boot.ipxe" ]]; then
+    SCRIPT="$SCRIPT_DIR/boot.ipxe"
+    info "Auto-detected script: $SCRIPT"
 fi
 
-EMBED_OPT=""
-[[ -n "$EMBED" ]] && EMBED_OPT="--embed $EMBED"
+SCRIPT_OPT=""
+[[ -n "$SCRIPT" ]] && SCRIPT_OPT="--script $SCRIPT"
 
 # ── Build matrix ──────────────────────────────────────────────────────────────
 #
-#  ipxe-x64.efi   — full iPXE with native tg3 driver (preferred for Intel Macs)
-#  snponly-x64.efi — SNP-only fallback (for Macs where tg3 probe fails)
+#  ipxe-x64.img    — native tg3 driver (try first on Intel Macs)
+#  snponly-x64.img — SNP fallback      (if tg3 probe fails)
 #
 echo -e "${C_BOLD}Mac iPXE build${C_RESET}"
 echo ""
 
-info "1/2  Native tg3 EFI binary (efi-x64)…"
-bash "$SCRIPT_DIR/build.sh" -p efi-x64 -j "$JOBS" $EMBED_OPT
+info "1/2  Native tg3 (efi-x64)…"
+bash "$SCRIPT_DIR/build.sh" -p efi-x64 -j "$JOBS" --image $SCRIPT_OPT
 echo ""
 
-info "2/2  SNP fallback binary (snp-x64)…"
-bash "$SCRIPT_DIR/build.sh" -p snp-x64 -j "$JOBS" $EMBED_OPT
+info "2/2  SNP fallback (snp-x64)…"
+bash "$SCRIPT_DIR/build.sh" -p snp-x64 -j "$JOBS" --image $SCRIPT_OPT
 echo ""
 
 # ── Summary ───────────────────────────────────────────────────────────────────
 BUILD_DIR="$SCRIPT_DIR/build"
-echo -e "${C_BOLD}Output files:${C_RESET}"
-for f in "$BUILD_DIR"/*.efi; do
+echo -e "${C_BOLD}Output:${C_RESET}"
+for f in "$BUILD_DIR"/*.img; do
     size=$(du -h "$f" | cut -f1)
     ok "  $size  $(basename "$f")"
 done
 
 echo ""
-echo -e "${C_BOLD}Usage on Mac:${C_RESET}"
-echo "  1. Copy ipxe-x64.efi to USB as /EFI/BOOT/BOOTX64.EFI"
-echo "  2. Boot Mac, hold Option key, select USB"
-echo "  3. If NIC not found, repeat with snponly-x64.efi"
+echo -e "${C_BOLD}Flash to USB (replace sdX):${C_RESET}"
+echo "  sudo dd if=$BUILD_DIR/ipxe-x64.img of=/dev/sdX bs=4M status=progress"
+echo ""
+echo -e "${C_BOLD}On Mac:${C_RESET}"
+echo "  Hold Option key at boot → select USB"
+echo "  If NIC not found, reflash with snponly-x64.img"
diff --git a/build.sh b/build.sh
index 424e70f2b..2b9b659d6 100755
--- a/build.sh
+++ b/build.sh
@@ -7,7 +7,9 @@
 #
 # Options:
 #   -p, --platform <name>   Platform to build (default: efi-x64)
-#   -e, --embed    <file>   iPXE script to embed (default: none)
+#   -e, --embed    <file>   iPXE script to embed into binary (default: none)
+#   -s, --script   <file>   iPXE script to include as autoexec.ipxe in image
+#   -i, --image             Create a bootable FAT32 .img alongside the binary
 #   -o, --output   <dir>    Output directory (default: ./build)
 #   -j, --jobs     <n>      Parallel jobs (default: nproc)
 #   -h, --help              Show this help
@@ -21,15 +23,17 @@
 #
 # Examples:
 #   ./build.sh
+#   ./build.sh -p efi-x64 -s boot.ipxe -i
 #   ./build.sh -p efi-x64 -e boot.ipxe
-#   ./build.sh -p bios -o ./out
-#   ./build.sh -p efi-x64 -e boot.ipxe -j 8
+#   ./build.sh -p bios -o ./out -j 8
 # =============================================================================
 set -euo pipefail
 
 # ── Defaults ──────────────────────────────────────────────────────────────────
 PLATFORM="efi-x64"
 EMBED=""
+SCRIPT=""
+MAKE_IMAGE=0
 OUTPUT_DIR="$(dirname "$0")/build"
 JOBS="$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)"
 SRC_DIR="$(cd "$(dirname "$0")/src" && pwd)"
@@ -49,7 +53,7 @@ die()   { echo -e "${C_RED}✘${C_RESET} $*" >&2; exit 1; }
 
 # ── Argument parsing ───────────────────────────────────────────────────────────
 usage() {
-    sed -n '3,20p' "$0" | sed 's/^# \{0,1\}//'
+    sed -n '3,22p' "$0" | sed 's/^# \{0,1\}//'
     exit 0
 }
 
@@ -57,6 +61,8 @@ while [[ $# -gt 0 ]]; do
     case $1 in
         -p|--platform) PLATFORM="$2"; shift 2 ;;
         -e|--embed)    EMBED="$2";    shift 2 ;;
+        -s|--script)   SCRIPT="$2";   shift 2 ;;
+        -i|--image)    MAKE_IMAGE=1;  shift   ;;
         -o|--output)   OUTPUT_DIR="$2"; shift 2 ;;
         -j|--jobs)     JOBS="$2";     shift 2 ;;
         -h|--help)     usage ;;
@@ -66,11 +72,11 @@ done
 
 # ── Platform → make target ─────────────────────────────────────────────────────
 case "$PLATFORM" in
-    efi-x64)   MAKE_TARGET="bin-x86_64-efi/ipxe.efi";    OUTPUT_NAME="ipxe-x64.efi"    ;;
-    efi-ia32)  MAKE_TARGET="bin-i386-efi/ipxe.efi";      OUTPUT_NAME="ipxe-ia32.efi"   ;;
-    efi-arm64) MAKE_TARGET="bin-arm64-efi/ipxe.efi";     OUTPUT_NAME="ipxe-arm64.efi"  ;;
-    snp-x64)   MAKE_TARGET="bin-x86_64-efi/snponly.efi"; OUTPUT_NAME="snponly-x64.efi" ;;
-    bios)      MAKE_TARGET="bin/undionly.kpxe";           OUTPUT_NAME="undionly.kpxe"   ;;
+    efi-x64)   MAKE_TARGET="bin-x86_64-efi/ipxe.efi";    OUTPUT_NAME="ipxe-x64.efi"    EFI_NAME="BOOTX64.EFI"   ;;
+    efi-ia32)  MAKE_TARGET="bin-i386-efi/ipxe.efi";      OUTPUT_NAME="ipxe-ia32.efi"   EFI_NAME="BOOTIA32.EFI"  ;;
+    efi-arm64) MAKE_TARGET="bin-arm64-efi/ipxe.efi";     OUTPUT_NAME="ipxe-arm64.efi"  EFI_NAME="BOOTAA64.EFI"  ;;
+    snp-x64)   MAKE_TARGET="bin-x86_64-efi/snponly.efi"; OUTPUT_NAME="snponly-x64.efi" EFI_NAME="BOOTX64.EFI"   ;;
+    bios)      MAKE_TARGET="bin/undionly.kpxe";           OUTPUT_NAME="undionly.kpxe"   EFI_NAME=""              ;;
     *) die "Unknown platform: '$PLATFORM'. Run with --help for valid platforms." ;;
 esac
 
@@ -79,16 +85,30 @@ esac
 
 EMBED_ABS=""
 if [[ -n "$EMBED" ]]; then
-    EMBED_ABS="$(realpath "$EMBED" 2>/dev/null)" || die "Embed script not found: $EMBED"
-    [[ -f "$EMBED_ABS" ]] || die "Embed script not found: $EMBED"
+    EMBED_ABS="$(realpath "$EMBED")" || die "Embed script not found: $EMBED"
+    [[ -f "$EMBED_ABS" ]]            || die "Embed script not found: $EMBED"
+fi
+
+SCRIPT_ABS=""
+if [[ -n "$SCRIPT" ]]; then
+    SCRIPT_ABS="$(realpath "$SCRIPT")" || die "Script not found: $SCRIPT"
+    [[ -f "$SCRIPT_ABS" ]]             || die "Script not found: $SCRIPT"
+fi
+
+if [[ $MAKE_IMAGE -eq 1 ]]; then
+    [[ -n "$EFI_NAME" ]] || die "--image is not supported for bios platform"
+    command -v mformat >/dev/null || die "mtools not installed (apt install mtools)"
+    command -v mcopy   >/dev/null || die "mtools not installed (apt install mtools)"
 fi
 
 # ── Summary ────────────────────────────────────────────────────────────────────
 mkdir -p "$OUTPUT_DIR"
 echo -e "${C_BOLD}Platform:${C_RESET} $PLATFORM  →  $MAKE_TARGET"
 echo -e "${C_BOLD}Jobs:${C_RESET}     $JOBS"
-echo -e "${C_BOLD}Embed:${C_RESET}    ${EMBED_ABS:-none}"
+[[ -n "$EMBED_ABS"  ]] && echo -e "${C_BOLD}Embed:${C_RESET}    $EMBED_ABS"
+[[ -n "$SCRIPT_ABS" ]] && echo -e "${C_BOLD}Script:${C_RESET}   $SCRIPT_ABS  (autoexec.ipxe)"
 echo -e "${C_BOLD}Output:${C_RESET}   $OUTPUT_DIR/$OUTPUT_NAME"
+[[ $MAKE_IMAGE -eq 1 ]] && echo -e "${C_BOLD}Image:${C_RESET}    $OUTPUT_DIR/${OUTPUT_NAME%.efi}.img"
 echo ""
 
 # ── Build ──────────────────────────────────────────────────────────────────────
@@ -100,22 +120,39 @@ else
     make -C "$SRC_DIR" "$MAKE_TARGET" -j "$JOBS"
 fi
 
-# ── Copy output ────────────────────────────────────────────────────────────────
+# ── Copy binary ────────────────────────────────────────────────────────────────
 BUILT_BIN="$SRC_DIR/$MAKE_TARGET"
 [[ -f "$BUILT_BIN" ]] || die "Build finished but output not found: $BUILT_BIN"
-
 cp "$BUILT_BIN" "$OUTPUT_DIR/$OUTPUT_NAME"
+ok "Binary: $OUTPUT_DIR/$OUTPUT_NAME"
 
-# ── Verify embedded script made it in ─────────────────────────────────────────
-if [[ -n "$EMBED_ABS" ]]; then
-    # Pull first line of the script and look for it in the binary
-    FIRST_LINE="$(head -1 "$EMBED_ABS")"
-    if strings "$OUTPUT_DIR/$OUTPUT_NAME" | grep -qF "$FIRST_LINE" 2>/dev/null; then
-        ok "Embed verified: script found in binary"
-    else
-        warn "Could not verify embed — 'strings' may not be installed, or check manually"
+# ── Create bootable image ──────────────────────────────────────────────────────
+if [[ $MAKE_IMAGE -eq 1 ]]; then
+    IMG="$OUTPUT_DIR/${OUTPUT_NAME%.efi}.img"
+    IMG_SIZE_MB=16
+
+    info "Creating FAT32 image ($IMG_SIZE_MB MB)…"
+
+    # Blank image
+    dd if=/dev/zero of="$IMG" bs=1M count=$IMG_SIZE_MB status=none
+
+    # Format as FAT32
+    mformat -i "$IMG" -F -v iPXE ::
+
+    # Create EFI/BOOT directory structure
+    mmd -i "$IMG" ::EFI
+    mmd -i "$IMG" ::EFI/BOOT
+
+    # Copy EFI binary as the standard boot filename
+    mcopy -i "$IMG" "$OUTPUT_DIR/$OUTPUT_NAME" "::EFI/BOOT/$EFI_NAME"
+
+    # Copy autoexec script if provided
+    if [[ -n "$SCRIPT_ABS" ]]; then
+        mcopy -i "$IMG" "$SCRIPT_ABS" "::EFI/BOOT/autoexec.ipxe"
+        ok "Script:  EFI/BOOT/autoexec.ipxe"
     fi
-fi
 
-echo ""
-ok "Built: $OUTPUT_DIR/$OUTPUT_NAME"
+    ok "Image:  $IMG"
+    echo ""
+    echo -e "  Flash to USB:  ${C_BOLD}sudo dd if=$IMG of=/dev/sdX bs=4M status=progress${C_RESET}"
+fi