diff --git a/.github/workflows/release-kiosk.yml b/.github/workflows/release-kiosk.yml
index ec3e3b6..bf409ec 100644
--- a/.github/workflows/release-kiosk.yml
+++ b/.github/workflows/release-kiosk.yml
@@ -15,6 +15,8 @@ name: release-kiosk
 
 on:
   push:
+    branches:
+      - master
     tags:
       - "v*"
   workflow_dispatch:
@@ -25,6 +27,12 @@ on:
         options: ["dev", "beta", "stable"]
         default: "dev"
 
+# Cancel an in-flight run when a newer commit lands on the same branch —
+# dev channel only needs the latest.
+concurrency:
+  group: release-kiosk-${{ github.ref }}
+  cancel-in-progress: ${{ github.ref_type != 'tag' }}
+
 permissions:
   contents: write
 
@@ -68,11 +76,15 @@ jobs:
           if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             channel="${{ inputs.channel }}"
             version="0.0.0-dev.$(git rev-parse --short HEAD)"
-          else
+          elif [[ "$GITHUB_REF" == refs/tags/v* ]]; then
             tag="${GITHUB_REF#refs/tags/v}"
             version="$tag"
             if [[ "$tag" == *"-beta."* ]]; then channel="beta";
             else channel="stable"; fi
+          else
+            # Push to master → auto dev channel build.
+            channel="dev"
+            version="0.0.0-dev.$(git rev-parse --short HEAD)"
           fi
           echo "channel=$channel" >> "$GITHUB_OUTPUT"
           echo "version=$version" >> "$GITHUB_OUTPUT"
diff --git a/kiosk/src/firmware.rs b/kiosk/src/firmware.rs
index 512e013..918c5ec 100644
--- a/kiosk/src/firmware.rs
+++ b/kiosk/src/firmware.rs
@@ -23,7 +23,7 @@ use std::path::PathBuf;
 use std::time::Duration;
 
 use base64::Engine as _;
-use ed25519_dalek::{Signature, Verifier, VerifyingKey};
+use ed25519_dalek::{Signature, Verifier, VerifyingKey, pkcs8::DecodePublicKey};
 use serde::Deserialize;
 use sha2::{Digest, Sha256};
 use tracing::{info, warn};
diff --git a/kiosk/src/main.rs b/kiosk/src/main.rs
index bc60006..9ad3cb4 100644
--- a/kiosk/src/main.rs
+++ b/kiosk/src/main.rs
@@ -9,6 +9,8 @@ mod pipeline;
 mod ui;
 mod ws_client;
 
+pub use ui::WorkerMsg;
+
 pub enum ServerMsg {
     ReloadBundle,
     Standby,
diff --git a/kiosk/src/ui.rs b/kiosk/src/ui.rs
index cf2c0d3..d7da3de 100644
--- a/kiosk/src/ui.rs
+++ b/kiosk/src/ui.rs
@@ -296,7 +296,7 @@ fn activate(app: &Application) {
     });
 }
 
-enum WorkerMsg {
+pub enum WorkerMsg {
     ShowPairingCode(String),
     RenderBundle(KioskBundle, String, String),
     SwitchLayout(u32),