diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 270e144f4b04b6e91172cee9e469954a8f95c105..0a40b6ea20d3c15d8b52474743493291059e906d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -6,27 +6,31 @@
     - m1
     - shell
   variables:
-    MACOS_RELEASE: "sonoma"
-    TAG_PREFIX: ""
-    CIRRUSLABS_TAG: "$MACOS_RELEASE-vanilla"
+    MACOS_VERSION: "sonoma"
+    TAG_PREFIX: "macos-sonoma-cgg-"
+    CIRRUSLABS_TAG: "$MACOS_VERSION-vanilla"
     TART_EXECUTOR_HOST_DIR: "true" # cf "Speeding up execution" @ https://github.com/cirruslabs/gitlab-tart-executor
 
   script:
-    - TAG_PREFIX="${TAG_PREFIX}${MACOS_RELEASE}-"
+    - security default-keychain -s "${HOME}/Library/Keychains/login.keychain-db"
     - security delete-keychain insecure || true
     - security create-keychain -p insecure insecure
     - security default-keychain -s insecure
     - security unlock-keychain -p insecure insecure
     - echo -n "${CI_JOB_TOKEN}" | tart login "${CI_REGISTRY}" --username gitlab-ci-token --password-stdin
+    - tart pull "ghcr.io/cirruslabs/macos-${MACOS_VERSION}-vanilla:latest"
+    - packer init templates/cgg.pkr.hcl
+    - packer build -var macos_version="$MACOS_VERSION" templates/cgg.pkr.hcl
+    - tart push $MACOS_VERSION-cgg "${CI_REGISTRY_IMAGE}:${TAG_PREFIX}latest"
+
 #    - tart clone 
 #    - TAG="${CI_REGISTRY_IMAGE}:${TAG_PREFIX}${CI_COMMIT_SHA}"
-#    - TAG_LATEST="${CI_REGISTRY_IMAGE}:${TAG_PREFIX}latest"
 #    - docker pull "${TAG_LATEST}" || true
 #    - >
 #      docker build
 #      --file ${DOCKERFILE}
 #      --pull
-#      --build-arg DEBIAN_TAG=${DEBIAN_RELEASE}-slim
+#      --build-arg DEBIAN_TAG=${DEBIAN_VERSION}-slim
 #      --build-arg VCS_REF=$CI_COMMIT_SHA
 #      --build-arg VCS_URL=$CI_PROJECT_URL
 #      --cache-from "${TAG_LATEST}"
@@ -45,7 +49,7 @@
 sonoma:
   extends: .template-macos
   variables:
-    MACOS_RELEASE: "sonoma"
+    MACOS_VERSION: "sonoma"
 
 # TODO: sequoia