diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 0dc7d11..bcb6cf4 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -1,11 +1,13 @@
+---
 name: Image
 
 on:
   workflow_dispatch:
+  schedule: [{ cron: "25 9 1,15 * *" }] # 9:25 on the 1st and 15th of the month
   push:
     branches: [main]
     paths:
-    - docker/*
+      - docker/*
 
 env:
   image: ghcr.io/${{ github.repository }}
@@ -15,31 +17,31 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - run: ./script/get-latest-obs.sh docker/obs.deb
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
+      - uses: actions/checkout@v4
+      - run: ./script/get-latest-obs.sh docker/obs.deb
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
 
-    - uses: docker/setup-buildx-action@v3
-    - uses: docker/login-action@v3
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.GITHUB_TOKEN }}
-    - uses: docker/build-push-action@v5
-      with:
-        context: ./docker
-        push: true
-        cache-from: type=registry,ref=${{ env.image }}:buildcache
-        cache-to: type=registry,ref=${{ env.image }}:buildcache,mode=max
-        tags: |
-          ${{ env.image }}:latest
-    - name: Tag with OBS versions included in our image
-      run: |
-        docker pull ${{ env.image }}:latest
-        set -x
-        obs_version=$(docker run --rm ${{ env.image }}:latest obs --version | tr -dc '[0-9.]')
-        websocket_version=$(docker run --rm ${{ env.image }}:latest timeout 2s xvfb-run obs | grep -Po 'websocket.+Version: \K\d+\.\d+\.\d+')
-        version_tagged="${{ env.image }}:$obs_version-$websocket_version"
-        docker tag ${{ env.image }}:latest "$version_tagged"
-        docker push "$version_tagged"
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/build-push-action@v5
+        with:
+          context: ./docker
+          push: true
+          cache-from: type=registry,ref=${{ env.image }}:buildcache
+          cache-to: type=registry,ref=${{ env.image }}:buildcache,mode=max
+          tags: |
+            ${{ env.image }}:latest
+      - name: Tag with OBS versions included in our image
+        run: |
+          docker pull ${{ env.image }}:latest
+          set -x
+          obs_version=$(docker run --rm ${{ env.image }}:latest obs --version | tr -dc '[0-9.]')
+          websocket_version=$(docker run --rm ${{ env.image }}:latest timeout 2s xvfb-run obs | grep -Po 'websocket.+Version: \K\d+\.\d+\.\d+')
+          version_tagged="${{ env.image }}:$obs_version-$websocket_version"
+          docker tag ${{ env.image }}:latest "$version_tagged"
+          docker push "$version_tagged"
diff --git a/docker/Dockerfile b/docker/Dockerfile
index b144948..71ccb2c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,12 +1,11 @@
 FROM ubuntu:latest AS build
 ENV DEBIAN_FRONTEND noninteractive
-RUN apt-get update -y
+RUN apt update -y
 COPY *.deb /tmp/obs.deb
-RUN dpkg -i /tmp/obs.deb || :
-RUN apt-get install -y --fix-broken
-RUN apt-get install -y qt6-wayland qt6-qpa-plugins
-RUN apt-get install -y xvfb x11vnc
-RUN apt-get install -y netcat
+RUN apt install /tmp/obs.deb -y
+RUN apt install -y qt6-wayland qt6-qpa-plugins
+RUN apt install -y xvfb x11vnc
+RUN apt install -y netcat-traditional
 RUN rm -rf /var/lib/apt/lists/*
 
 # effectively always run with --init as xvfb-run needs signal propagation
diff --git a/script/get-latest-obs.sh b/script/get-latest-obs.sh
index 01d139e..3cf6389 100755
--- a/script/get-latest-obs.sh
+++ b/script/get-latest-obs.sh
@@ -6,28 +6,44 @@ main() {
         download_artifact >/tmp/obs.zip
         rm -rf /tmp/obs
         unzip -od /tmp/obs /tmp/obs.zip
+
+        # the names are different in their sha256 file
+        expected=$(cut -d' ' -f1 /tmp/obs/*.sha256 | awk '{print $1}')
         mv /tmp/obs/*.deb "$path"
+        echo "$expected $path" | sha256sum --check
         ls -al "$path"
 }
 
 download_artifact() {
         repo=obsproject/obs-studio
-        id=$(gh api /repos/$repo/actions/artifacts --jq '
-                [
+        artifacts_url=$(
+                gh api -XGET /repos/$repo/actions/runs \
+                        -fbranch=master \
+                        -fstatus=completed \
+                        -fexclude_pull_requests=true \
+                        -fevent=push \
+                        --jq '
+                                [
+                                        .workflow_runs[]
+                                        | select(.path==".github/workflows/push.yaml")
+                                ]
+                                | sort_by(.created_at)
+                                | reverse
+                                | first
+                                | .artifacts_url
+                        '
+        )
+        archive_download_url=$(
+                gh api "$artifacts_url" --jq '
                         .artifacts[]
-                        | select(
-                                .workflow_run.head_branch == "master" and
-                                (.name|contains("ubuntu")) and
-                                (.name|contains("dbgsym")|not)
-                        )
-                ]
-                | sort_by(.created_at)
-                | reverse
-                | first
-                | .id
-        ')
-        gh api "/repos/$repo/actions/artifacts/$id/zip"
+                        |= select(.name | test("ubuntu-2[4-9].[0-9]{2}-x86_64-[0-9a-f]+$"))
+                        | .artifacts
+                        | first
+                        | .archive_download_url
+                '
+        )
+        gh api "$archive_download_url"
 }
 
-set -eu
+set -eux
 main "$@"