diff --git a/.github/workflows/build-one.yml b/.github/workflows/build-one.yml
index 5b23430..a33d7b2 100644
--- a/.github/workflows/build-one.yml
+++ b/.github/workflows/build-one.yml
@@ -5,18 +5,44 @@ on:
       platform:
         description: 'Platform to build (e.g. hi3518ev200_lite_switcam-hs303-v2)'
         required: true
-
-env:
-  TAG_NAME: latest
+      commit:
+        description: 'Commit SHA to build (optional; defaults to current branch HEAD). Use this from `git bisect run` or for one-off historic rebuilds.'
+        required: false
 
 jobs:
+  resolve:
+    name: Resolve commit
+    runs-on: ubuntu-latest
+    outputs:
+      ref:       ${{ steps.r.outputs.ref }}
+      short_sha: ${{ steps.r.outputs.short_sha }}
+      tag_name:  ${{ steps.r.outputs.tag_name }}
+    steps:
+      - id: r
+        run: |
+          REF="${{ inputs.commit }}"
+          [ -z "$REF" ] && REF="${{ github.sha }}"
+          SHORT="$(printf '%s' "$REF" | cut -c1-7)"
+          if [ -n "${{ inputs.commit }}" ]; then
+            TAG="nightly-bisect-${SHORT}"
+          else
+            TAG="nightly-bisect-${SHORT}-$(date -u +%Y%m%d%H%M%S)"
+          fi
+          echo "ref=$REF"               >> "$GITHUB_OUTPUT"
+          echo "short_sha=$SHORT"       >> "$GITHUB_OUTPUT"
+          echo "tag_name=$TAG"          >> "$GITHUB_OUTPUT"
+          echo "Building ${{ inputs.platform }} at $REF -> release tag $TAG"
+
   buildroot:
     name: Firmware (${{inputs.platform}})
+    needs: resolve
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout source
         uses: actions/checkout@v4
+        with:
+          ref: ${{ needs.resolve.outputs.ref }}
 
       - name: Prepare firmware
         run: |
@@ -30,6 +56,10 @@ jobs:
           key: ${{inputs.platform}}-${{env.CACHE_DATE}}
 
       - name: Build firmware
+        env:
+          BUILD_ID:       ${{ needs.resolve.outputs.tag_name }}
+          BUILD_SHA:      ${{ needs.resolve.outputs.ref }}
+          BUILD_PLATFORM: ${{ inputs.platform }}
         run: |
           export GIT_HASH=$(git rev-parse --short ${GITHUB_SHA})
           export GIT_BRANCH=${GITHUB_REF_NAME}
@@ -40,7 +70,20 @@ jobs:
           ln -s /tmp/ccache ${HOME}/.ccache
 
           NAME=${{inputs.platform}}
-          bash builder.sh ${NAME}
+          # Retry budget for transient upstream toolchain/CDN flakes
+          # (matches master.yml + OpenIPC/firmware/build-one.yml).
+          backoffs="30 60 120 300 600 1200"
+          attempt=1
+          for sleep_for in $backoffs ""; do
+            bash builder.sh ${NAME} && break
+            if [ -z "$sleep_for" ]; then
+              echo "::error::build failed after ${attempt} attempts"
+              exit 1
+            fi
+            echo "::warning::attempt ${attempt} failed, retrying after ${sleep_for}s"
+            sleep "$sleep_for"
+            attempt=$((attempt + 1))
+          done
           cd openipc
 
           TIME=$(date -d @${SECONDS} +%M:%S)
@@ -75,7 +118,13 @@ jobs:
         if: env.NORFW || env.NANDFW
         uses: softprops/action-gh-release@v2
         with:
-          tag_name: ${{env.TAG_NAME}}
+          tag_name: ${{ needs.resolve.outputs.tag_name }}
+          prerelease: true
+          body: |
+            sha=${{ needs.resolve.outputs.ref }}
+            short=${{ needs.resolve.outputs.short_sha }}
+            platform=${{ inputs.platform }}
+            one_off=true
           files: |
             ${{env.NORFW}}
             ${{env.NANDFW}}