diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..651dc49
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,241 @@
+name: build
+
+on:
+  push:
+    branches: [ "kirkstone-tisdk-9" ]
+  pull_request:
+    branches: [ "kirkstone-tisdk-9" ]
+  schedule:
+    - cron: "0 0 * * 5"
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+jobs:
+  prepare_container:
+    runs-on: self-hosted
+    outputs:
+      uid: ${{ steps.uid_step.outputs.userid }}
+      gid: ${{ steps.uid_step.outputs.groupid }}
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - uses: actions/checkout@v4
+
+      - name: Get user id/group
+        id: uid_step
+        run: |
+          echo "userid=$(id -u)" >> "$GITHUB_OUTPUT"
+          echo "groupid=$(id -g)" >> "$GITHUB_OUTPUT"
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          buildkitd-config: /etc/docker/cibuilder.toml
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ciserver.ci:5000
+          username: ${{ secrets.CI_CACHE_REGISTRY_LOGIN }}
+          password: ${{ secrets.CI_CACHE_REGISTRY_PASSWORD }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          push: true
+          tags: ciserver.ci:5000/${{ github.repository_id }}:latest
+          cache-from: type=registry,ref=ciserver.ci:5000/${{ github.repository_id }}:cache
+          cache-to: type=registry,ref=ciserver.ci:5000/${{ github.repository_id }}:cache,mode=max
+          file: conf/docker/Dockerfile
+          build-args: |
+            USER_ID=${{ steps.uid_step.outputs.userid }}
+            GROUP_ID=${{ steps.uid_step.outputs.groupid }}
+
+  build_images:
+    needs: prepare_container
+    runs-on: self-hosted
+    timeout-minutes: 1080
+    container:
+        image: ciserver.ci:5000/${{ github.repository_id }}:latest
+        credentials:
+            username: ${{ secrets.CI_CACHE_REGISTRY_LOGIN }}
+            password: ${{ secrets.CI_CACHE_REGISTRY_PASSWORD }}
+        options: --user "${{ needs.prepare_container.outputs.uid }}:${{ needs.prepare_container.outputs.gid }}"
+    outputs:
+      build_tag: ${{ steps.tag_step.outputs.build_tag }}
+    steps:
+      - name: Checkout parent tisdk
+        uses: actions/checkout@v4
+        with:
+          ref: tisdk
+
+      - name: Checkout dependency layers
+        run: |
+          ./oe-layertool-setup.sh -f configs/processor-sdk/processor-sdk-09.02.00.09-am64x-config.txt
+          rm -rf sources/meta-solidrun-arm-am64
+
+      - name: Checkout pull-request version of meta-solidrun-arm-am64
+        uses: actions/checkout@v4
+        with:
+          path: sources/meta-solidrun-arm-am64
+
+      - name: Get build tag
+        id: tag_step
+        run: |
+          build_tag=$(date +%Y-%m-%d)_$(cd sources/meta-solidrun-arm-am64; git rev-parse --short HEAD)
+          echo "build_tag=$build_tag" >> "$GITHUB_OUTPUT"
+
+      - name: Create cache dir
+        run: mkdir -p buildcache
+
+      - name: Fetch cache from server
+        uses: tespkg/actions-cache/restore@v1
+        with:
+          endpoint: ciserver.ci
+          port: 9000
+          insecure: true
+          accessKey: ${{ secrets.CI_CACHE_MINIO_ACCESS }}
+          secretKey: ${{ secrets.CI_CACHE_MINIO_SECRET }}
+          bucket: cicache
+          use-fallback: false
+          key: ${{ github.repository }}
+          path: |
+            buildcache
+
+      - name: Inject CI Configuration
+        shell: bash
+        run: |
+            WORKDIR=$(pwd)
+            cd build
+            echo "require conf/includes/ci.conf" >> conf/local.conf
+
+      - name: Download Sources
+        shell: bash
+        run: |
+            WORKDIR=$(pwd)
+            cd build
+            . conf/setenv
+            export CACHE_DIR="$WORKDIR/buildcache"
+            export BB_ENV_PASSTHROUGH_ADDITIONS="$BB_ENV_PASSTHROUGH_ADDITIONS CACHE_DIR"
+            echo "require conf/includes/ci.conf" >> conf/local.conf
+            MACHINE=am64xx-sr-som bitbake tisdk-default-image --runall=fetch
+        continue-on-error: true
+
+      - name: Build (ignore errors)
+        shell: bash
+        run: |
+            WORKDIR=$(pwd)
+            cd build
+            . conf/setenv
+            export CACHE_DIR="$WORKDIR/buildcache"
+            export BB_ENV_PASSTHROUGH_ADDITIONS="$BB_ENV_PASSTHROUGH_ADDITIONS CACHE_DIR"
+            cat conf/local.conf
+            MACHINE=am64xx-sr-som bitbake -k tisdk-default-image
+            TOOLCHAIN_OUTPUTNAME="\${SDKMACHINE}-\${SDK_NAME}-toolchain-\${SDK_VERSION}" SDK_PACKAGING_FUNC=0 SDKMACHINE=x86_64 SDK_ARCHIVE_TYPE=tar.xz MACHINE=am64xx-sr-som bitbake -k tisdk-default-image -c populate_sdk
+#            TOOLCHAIN_OUTPUTNAME="\${SDKMACHINE}-\${SDK_NAME}-toolchain-\${SDK_VERSION}" SDK_PACKAGING_FUNC=0 SDKMACHINE=x86_64-mingw32 SDK_ARCHIVE_TYPE=zip MACHINE=am64xx-sr-som bitbake -k tisdk-default-image -c populate_sdk
+        continue-on-error: true
+
+      - name: Update cache on the server (build may have failed)
+#        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        uses: tespkg/actions-cache/save@v1
+        with:
+          endpoint: ciserver.ci
+          port: 9000
+          insecure: true
+          accessKey: ${{ secrets.CI_CACHE_MINIO_ACCESS }}
+          secretKey: ${{ secrets.CI_CACHE_MINIO_SECRET }}
+          bucket: cicache
+          use-fallback: false
+          key: ${{ github.repository }}
+          path: |
+            buildcache
+
+      - name: Build
+        shell: bash
+        run: |
+            WORKDIR=$(pwd)
+            cd build
+            . conf/setenv
+            export CACHE_DIR="$WORKDIR/buildcache"
+            export BB_ENV_PASSTHROUGH_ADDITIONS="$BB_ENV_PASSTHROUGH_ADDITIONS CACHE_DIR"
+            cat conf/local.conf
+            MACHINE=am64xx-sr-som bitbake tisdk-default-image
+            TOOLCHAIN_OUTPUTNAME="\${SDKMACHINE}-\${SDK_NAME}-toolchain-\${SDK_VERSION}" SDK_PACKAGING_FUNC=0 SDKMACHINE=x86_64 SDK_ARCHIVE_TYPE=tar.xz MACHINE=am64xx-sr-som bitbake tisdk-default-image -c populate_sdk
+#            TOOLCHAIN_OUTPUTNAME="\${SDKMACHINE}-\${SDK_NAME}-toolchain-\${SDK_VERSION}" SDK_PACKAGING_FUNC=0 SDKMACHINE=x86_64-mingw32 SDK_ARCHIVE_TYPE=zip MACHINE=am64xx-sr-som bitbake tisdk-default-image -c populate_sdk
+
+      - name: Update cache on the server (build has succeeded)
+#        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+        uses: tespkg/actions-cache/save@v1
+        with:
+          endpoint: ciserver.ci
+          port: 9000
+          insecure: true
+          accessKey: ${{ secrets.CI_CACHE_MINIO_ACCESS }}
+          secretKey: ${{ secrets.CI_CACHE_MINIO_SECRET }}
+          bucket: cicache
+          use-fallback: false
+          key: ${{ github.repository }}
+          path: |
+            buildcache
+
+      - name: Select artifacts for publishing
+        shell: bash
+        run: |
+            mkdir deploy
+            DEPLOY_PATH=build/deploy-ti/images/am64xx-sr-som
+            SDK_PATH=build/deploy-ti/sdk
+            cp -L $DEPLOY_PATH/tiboot3-am64x-gp-sr-som.bin deploy/
+            cp -L $DEPLOY_PATH/tiboot3-am64x_sr2-hs-fs-sr-som.bin deploy/
+            cp -L $DEPLOY_PATH/tispl.bin deploy/
+            cp -L $DEPLOY_PATH/u-boot.img deploy/
+            cp -L $DEPLOY_PATH/k3-am642-sr-som.dtb deploy/
+            cp -L $DEPLOY_PATH/k3-am642-hummingboard-t.dtb deploy/
+            cp -L $DEPLOY_PATH/k3-am642-hummingboard-t-pcie.dtb deploy/
+            cp -L $DEPLOY_PATH/k3-am642-hummingboard-t-usb3.dtb deploy/
+            cp -L $DEPLOY_PATH/Image deploy/
+            cp -L $DEPLOY_PATH/modules-am64xx-sr-som.tgz deploy/
+            cp -L $DEPLOY_PATH/fitImage deploy/
+            cp -L $DEPLOY_PATH/tisdk-default-image-am64xx-sr-som.manifest deploy/
+            cp -L $DEPLOY_PATH/tisdk-default-image-am64xx-sr-som.tar.xz deploy/
+            cp -L $DEPLOY_PATH/tisdk-default-image-am64xx-sr-som.wic.bmap deploy/
+            cp -L $DEPLOY_PATH/tisdk-default-image-am64xx-sr-som.wic.xz deploy/
+            cp -L $SDK_PATH/*.manifest $SDK_PATH/*.sh deploy/
+
+      - name: Deploy to the local minio storage
+        uses: yakubique/minio-upload@v1.1.3
+        with:
+          endpoint: http://ciserver.ci:9000
+          insecure: true
+          access_key: ${{ secrets.CI_CACHE_MINIO_ACCESS }}
+          secret_key: ${{ secrets.CI_CACHE_MINIO_SECRET }}
+          bucket: cipublish
+          source: ./deploy
+          target: "/${{ github.repository_id }}/${{ steps.tag_step.outputs.build_tag }}"
+          recursive: true
+
+  publish_images:
+    needs: build_images
+    runs-on: self-hosted
+    if: github.event_name == 'push'
+    steps:
+      - name: Download an artifacts from MinIO
+        uses: yakubique/minio-download@v1.1.1
+        with:
+          endpoint: http://ciserver.ci:9000
+          insecure: true
+          access_key: ${{ secrets.CI_CACHE_MINIO_ACCESS }}
+          secret_key: ${{ secrets.CI_CACHE_MINIO_SECRET }}
+          bucket: cipublish
+          source: "/${{ github.repository_id }}/${{ needs.build_images.outputs.build_tag }}/"
+          target: "."
+          recursive: true
+
+      - name: Upload to S3
+        uses: shallwefootball/upload-s3-action@v1.3.3
+        with:
+          aws_key_id: ${{ secrets.IMAGES_S3_ACCESS }}
+          aws_secret_access_key: ${{ secrets.IMAGES_S3_SECRET }}
+          aws_bucket: ${{ secrets.IMAGES_S3_BUCKET }}
+          endpoint: ${{ secrets.IMAGES_S3_HOST }}
+          source_dir: deploy
+          destination_dir: AM64X/meta-solidrun-arm-am64/${{ needs.build_images.outputs.build_tag }}
diff --git a/conf/docker/Dockerfile b/conf/docker/Dockerfile
new file mode 100644
index 0000000..ef020ea
--- /dev/null
+++ b/conf/docker/Dockerfile
@@ -0,0 +1,46 @@
+FROM ubuntu:22.04
+
+# Set the default shell to bash
+SHELL ["/bin/bash", "-c"]
+
+# Install necessary packages and dependencies for Yocto builds.
+# This includes all the recommended packages listed in the Yocto Project Quick Start
+# guide for a Ubuntu-based host, plus packages listed in TI Documentation.
+ENV DEBIAN_FRONTEND noninteractive
+RUN apt-get update && apt-get install -y  \
+	apt-transport-https bash bison build-essential ca-certificates chrpath cpio curl \
+	debianutils diffstat dos2unix doxygen file flex gawk gcc git git-lfs g++-multilib \
+	icecc iputils-ping jq libacl1 libc6-dev-i386 libegl1-mesa liblz4-tool \
+	libsdl1.2-dev libssl-dev locales locales lz4 mesa-common-dev mono-complete \
+	mono-devel patchelf pigz pseudo python3 python3-distutils python3-git \
+	python3-jinja2 python3-pexpect python3-pip python3-sphinx python3-subunit repo \
+	socat sudo texinfo tree u-boot-tools unzip wget xz-utils zstd
+RUN locale-gen en_US.UTF-8
+RUN update-ca-certificates
+
+# Set environment variables
+ENV LANG=en_US.UTF-8 \
+    LANGUAGE=en_US:en \
+    LC_ALL=en_US.UTF-8
+
+# Arguments to pass host user's UID and GID
+ARG USER_ID=1000
+ARG GROUP_ID=1000
+
+# Create a user 'developer' with the same UID/GID as the host user
+RUN groupadd -g ${GROUP_ID} developer
+RUN useradd -m -u ${USER_ID} -g developer -d /home/developer developer
+RUN mkdir -p /workspace
+RUN chown -R developer:developer /workspace
+RUN mkdir -p /home/developer/.ssh
+RUN touch /home/developer/.ssh/known_hosts
+RUN chmod 700 /home/developer/.ssh
+RUN chmod 600 /home/developer/.ssh/known_hosts
+RUN chown -R developer:developer /home/developer/.ssh
+
+RUN git config --add --system user.email "developer@example.com"
+RUN git config --add --system user.name "Build Container"
+RUN git config --add --system http.version HTTP/1.1
+
+# The entry point is set to bash. This means that when the container starts, it will drop the user into bash
+ENTRYPOINT ["/bin/bash"]
diff --git a/conf/includes/ci.conf b/conf/includes/ci.conf
new file mode 100644
index 0000000..bead05a
--- /dev/null
+++ b/conf/includes/ci.conf
@@ -0,0 +1,14 @@
+CACHE_DIR ??= "${TOPDIR}"
+
+BB_GENERATE_MIRROR_TARBALLS = "1"
+BB_GIT_SHALLOW ?= "1"
+BB_GIT_SHALLOW_DEPTH ?= "1"
+
+DL_DIR = "${CACHE_DIR}/downloads"
+SSTATE_DIR = "${CACHE_DIR}/sstate-cache"
+CCACHE_TOP_DIR = "${CACHE_DIR}/ccache"
+
+INHERIT += "ccache"
+
+# might break build in atf, cross-compiler missing from path
+#INHERIT += "rm_work"
diff --git a/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
new file mode 100644
index 0000000..165e7f4
--- /dev/null
+++ b/recipes-bsp/trusted-firmware-a/trusted-firmware-a_%.bbappend
@@ -0,0 +1 @@
+DEPENDS += " virtual/${TARGET_PREFIX}gcc"