diff --git a/.github/workflows/lintBuildTest.yml b/.github/workflows/lintBuildTest.yml
index 49bb94589..447ef6f6d 100644
--- a/.github/workflows/lintBuildTest.yml
+++ b/.github/workflows/lintBuildTest.yml
@@ -49,8 +49,9 @@ jobs:
         run: npm run fmt:check
       - name: Test
         run: npm test run -- --project unit
-      - name: Build
-        run: npm run build
+      # Same packaging as upload-assets.yaml, minus the upload
+      - name: Build and package
+        run: SHA=${{ github.sha }} .github/workflows/package.sh
   playwright:
     name: Playwright (${{ matrix.playwright }})
     timeout-minutes: 20
diff --git a/.github/workflows/package.sh b/.github/workflows/package.sh
new file mode 100755
index 000000000..422565391
--- /dev/null
+++ b/.github/workflows/package.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# Copyright Oxide Computer Company
+
+set -euxo pipefail
+
+npm run build
+# Gzip individual files (keep originals)
+ls build/client/assets/*.{js,css,map} | xargs gzip --keep
+# add console_version file
+echo "${SHA}" > build/client/VERSION
+# add API_VERSION file
+cp app/api/__generated__/API_VERSION build/client/API_VERSION
+
+mkdir -p releases/console
+# Make <sha>.tar.gz
+tar czf releases/console/"${SHA}".tar.gz --directory=build/client .
+# Write sha256sum to file
+sha256sum releases/console/"${SHA}".tar.gz | awk '{print $1}' > releases/console/"${SHA}".sha256.txt
diff --git a/.github/workflows/upload-assets.yaml b/.github/workflows/upload-assets.yaml
index 1ed84987c..7c135eac8 100644
--- a/.github/workflows/upload-assets.yaml
+++ b/.github/workflows/upload-assets.yaml
@@ -23,19 +23,12 @@ jobs:
         with:
           project_id: oxide-downloads
       - run: npm install
+
+      # Keep all packaging commands in .github/workflows/package.sh so that
+      # source escrow tooling can re-use the same commands.
       - name: Build for Nexus
-        run: SHA=${{ github.sha }} npm run build
-      - name: Gzip individual files (keep originals)
-        run: ls build/client/assets/*.{js,css,map} | xargs gzip --keep
-      - name: add console_version file
-        run: echo ${{ github.sha }} > build/client/VERSION
-      - name: add API_VERSION file
-        run: cp app/api/__generated__/API_VERSION build/client/API_VERSION
-      - run: mkdir -p releases/console
-      - name: Make <sha>.tar.gz
-        run: tar czf releases/console/${{ github.sha }}.tar.gz --directory=build/client .
-      - name: Write sha256sum to file
-        run: sha256sum releases/console/${{ github.sha }}.tar.gz | awk '{print $1}' > releases/console/${{ github.sha }}.sha256.txt
+        run: SHA=${{ github.sha }} .github/workflows/package.sh
+
       - name: Upload files to GCP bucket
         id: upload-files
         uses: google-github-actions/upload-cloud-storage@v3
diff --git a/.gitignore b/.gitignore
index 6a5378ae9..d28ce00ca 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,6 @@ test/visual/**/*.png
 
 # React Router build output. build/client is the deployable static site
 /build/
+
+# package.sh output (.github/workflows/package.sh)
+/releases/