diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 43a1feaea6..1b1607ebc1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -133,11 +133,15 @@ jobs:
         go-version: ^1.14
       id: go
 
-    - name: Build Image
+    - name: Prepare Image
       run: |
+        make prepare-image
+        sed -e 's/-ld.*$/& -X github.com/andig/evcc/server/updater.Password=${{ secrets.IMAGE_PASS }}/' buildflags/github.com/andig/evcc/buildflags.txt > buildflags/github.com/andig/evcc/buildflags.txt
         mkdir /home/runner/.config/gokrazy
         echo ${{ secrets.IMAGE_PASS }}> /home/runner/.config/gokrazy/http-password.txt
-        make image
+
+    - name: Build Image
+      run: make image
 
     - name: Build Root Filesystem
       run: make image-rootfs
diff --git a/.gitignore b/.gitignore
index 0436b6e3f1..38557518c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,14 +1,16 @@
 __debug_bin
 .vscode
-*.json
-!package*.json
-*.log
 .cache
+*.py
+*.log
+*.json
 *.yaml
+!package*.json
+!evcc.dist.yaml
 evcc
 evcc_*
+flags/*
+buildflags/*
 linux-*.Dockerfile
-!evcc.dist.yaml
 dist
-*.py
 node_modules
diff --git a/Makefile b/Makefile
index c39f2de210..b7a76a448a 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,9 @@ TAG_NAME := $(shell test -d .git && git describe --abbrev=0 --tags)
 SHA := $(shell test -d .git && git rev-parse --short HEAD)
 VERSION := $(if $(TAG_NAME),$(TAG_NAME),$(SHA))
 BUILD_DATE := $(shell date -u '+%Y-%m-%d_%H:%M:%S')
-BUILD_ARGS := -tags=release -ldflags '-X "github.com/andig/evcc/server.Version=$(VERSION)" -X "github.com/andig/evcc/server.Commit=$(SHA)"'
+BUILD_TAGS := -tags=release
+LD_FLAGS := -X github.com/andig/evcc/server.Version=$(VERSION) -X github.com/andig/evcc/server.Commit=$(SHA)
+BUILD_ARGS := -ldflags='$(LD_FLAGS)'
 
 # docker
 DOCKER_IMAGE := andig/evcc
@@ -17,7 +19,7 @@ TARGETS := arm.v6,arm.v8,amd64
 # image
 IMAGE_FILE := evcc_$(TAG_NAME).image
 IMAGE_ROOTFS := evcc_$(TAG_NAME).rootfs
-IMAGE_OPTIONS := -hostname evcc -http_port 8080 github.com/gokrazy/serial-busybox github.com/andig/brokenglass github.com/andig/evcc
+IMAGE_OPTIONS := -hostname evcc -http_port 8080 github.com/gokrazy/serial-busybox github.com/gokrazy/breakglass github.com/andig/evcc
 
 default: clean install npm assets lint test build
 
@@ -50,7 +52,7 @@ assets:
 
 build:
 	@echo Version: $(VERSION) $(BUILD_DATE)
-	go build -v $(BUILD_ARGS)
+	go build -v $(BUILD_TAGS) $(BUILD_ARGS)
 
 release-test:
 	goreleaser --snapshot --skip-publish --rm-dist
@@ -73,23 +75,22 @@ publish-images:
 	seihon publish --dry-run=false --template docker/tmpl.Dockerfile --base-runtime-image alpine:$(ALPINE_VERSION) \
 	   --image-name $(DOCKER_IMAGE) -v "latest" -v "$(TAG_NAME)" --targets=$(TARGETS)
 
+image-prepare:
+	go get github.com/gokrazy/tools/cmd/gokr-packer@latest
+	mkdir -p flags/github.com/gokrazy/breakglass
+	echo "-forward=private-network" > flags/github.com/gokrazy/breakglass/flags.txt
+	mkdir -p buildflags/github.com/andig/evcc
+	echo "$(BUILD_TAGS),gokrazy" > buildflags/github.com/andig/evcc/buildflags.txt
+	echo "-ldflags=$(LD_FLAGS)" >> buildflags/github.com/andig/evcc/buildflags.txt
+
 image:
-	go get github.com/gokrazy/tools/cmd/gokr-packer
-	mkdir -p buildargs/github.com/andig/evcc
-	echo "$(BUILD_ARGS)" > buildargs/github.com/andig/evcc/buildargs.txt
 	gokr-packer -overwrite=$(IMAGE_FILE) -target_storage_bytes=1258299392 $(IMAGE_OPTIONS)
-
-	# create filesystem
 	loop=$$(sudo losetup --find --show -P $(IMAGE_FILE)); sudo mkfs.ext4 $${loop}p4
-	gzip -f -k $(IMAGE_FILE)
+	gzip -f $(IMAGE_FILE)
 
 image-rootfs:
-	mkdir -p buildargs/github.com/andig/evcc
-	echo "$(BUILD_ARGS)" > buildargs/github.com/andig/evcc/buildargs.txt
 	gokr-packer -overwrite_root=$(IMAGE_ROOTFS) $(IMAGE_OPTIONS)
-	gzip -f -k $(IMAGE_ROOTFS)
+	gzip -f $(IMAGE_ROOTFS)
 
 image-update:
-	mkdir -p buildargs/github.com/andig/evcc
-	echo "$(BUILD_ARGS)" > buildargs/github.com/andig/evcc/buildargs.txt
 	gokr-packer -update yes $(IMAGE_OPTIONS)
diff --git a/server/updater/gokrazy.go b/server/updater/gokrazy.go
index 82f941e62a..ef1bfe9856 100644
--- a/server/updater/gokrazy.go
+++ b/server/updater/gokrazy.go
@@ -18,8 +18,10 @@ const (
 	MB         = 1024 * 1024
 	RootOffset = 8192*512 + 100*MB
 	RootSize   = 500 * MB
+	RootFS     = "evcc_%s.rootfs.gz"
+)
 
-	RootFS   = "evcc_%s.rootfs.gz"
+var (
 	Password = "FIat2WTD8i3tJikkvIJI"
 	Port     = 8080
 )