diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index f0900148..d7847538 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -10,26 +10,12 @@ jobs:
     steps:
       - uses: actions/checkout@v3
       - run: >
-          grep -E '  github: [^\w]+/[^\w]+' projects/**/package.yml |
+          grep -E '  github: [^\w]+/[^\w/]+' projects/**/package.yml |
           sed -e 's|^projects/\(.*\)/package.yml: *github: \([^/]*/[^/]*\).*|{ "project": "\1", "github": "\2" }|' |
           jq -sc . |
           curl https://app.tea.xyz/api/receiveWatcherProjects --fail -X PUT \
             -H "content-type: application/json" -H "authorization: bearer ${{ secrets.TEA_API_TOKEN }}" -d @-
-  get-diff:
-    runs-on: ubuntu-latest
-    outputs:
-      diff: ${{ steps.diff.outputs.diff }}
-    steps:
-      - uses: actions/checkout@v3
-      - uses: technote-space/get-diff-action@v6
-        id: diff
-        with:
-          PATTERNS: projects/**/package.yml
-  build:
-    needs: [get-diff]
-    uses: teaxyz/pantry.core/.github/workflows/build.yml@main
-    with:
-      projects: ${{ needs.get-diff.outputs.diff }}
-      upload: true
+  bottle:
+    #FIXME: will fail (harmlessly) on non-merge/non-new-version runs
+    uses: teaxyz/pantry.core/.github/workflows/bottle.yml@main
     secrets: inherit
-    if: ${{ needs.get-diff.outputs.diff != '' }}
\ No newline at end of file
diff --git a/.github/workflows/ci-scripts.yml b/.github/workflows/ci-scripts.yml
deleted file mode 100644
index 196a1db9..00000000
--- a/.github/workflows/ci-scripts.yml
+++ /dev/null
@@ -1,11 +0,0 @@
-on:
-  pull_request:
-    paths: scripts/**.ts
-
-jobs:
-  typecheck:
-    runs-on: ubuntu-latest
-    env:
-      TEA_SECRET: ${{ secrets.TEA_SECRET }}
-    steps:
-      - uses: actions/checkout@v3
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
new file mode 100644
index 00000000..ef7f2bca
--- /dev/null
+++ b/.github/workflows/cleanup.yml
@@ -0,0 +1,24 @@
+name: cleanup
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Configure AWS Credentials
+        uses: aws-actions/configure-aws-credentials@v1
+        with:
+          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          aws-region: us-east-1
+      - name: remove staged artifacts
+        run: |
+          REPO=$(echo ${{github.repository}} | sed -e 's_teaxyz/__')
+          PR=$(echo ${{github.ref}} | sed -e 's_refs/pull/\(.*\)/merge_\1_')
+
+          aws s3 rm --recursive s3://$AWS_S3_CACHE/pull-request/$REPO/$PR
+        if: startsWith(github.ref, 'refs/pull/') && startsWith(github.repository, 'teaxyz/pantry.')
+        env:
+          AWS_S3_CACHE: ${{ secrets.AWS_S3_CACHE }}
\ No newline at end of file
diff --git a/.github/workflows/new-version.yml b/.github/workflows/new-version.yml
deleted file mode 100644
index 1d583e03..00000000
--- a/.github/workflows/new-version.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: new-version
-run-name: new-version (${{ inputs.projects }})
-on:
-  workflow_dispatch:
-    inputs:
-      projects:
-        description: eg. `foo.com@1.2.3 bar.com@2.3.4`
-        required: true
-        type: string
-
-jobs:
-  build:
-    uses: teaxyz/pantry.core/.github/workflows/build.yml@main
-    with:
-      projects: ${{ inputs.projects }}
-      upload: true
-    secrets: inherit
\ No newline at end of file