diff --git a/.github/workflows/build-wheel-linux.yml b/.github/workflows/build-wheel-linux.yml
index 0dea81b..c146e1f 100644
--- a/.github/workflows/build-wheel-linux.yml
+++ b/.github/workflows/build-wheel-linux.yml
@@ -19,73 +19,28 @@ on:
   # TODO automation trigger
 
 jobs:
-
   build:
-
-    runs-on: [self-hosted, Linux, platform-builder-Rocky-8.6]
-    # TODO which manylinux do we want to build for? 2014? 2_28? 2_34? Matrix?
-    container: wheelmaker_2_28:0.1
-
     name: Build manylinux_2_28
-
-    steps:
-      # TODO which project do we build odc wheel from -- this, or some bundle? Or can we obtain the compiled eckit artifact somehow?
-      - run: git clone --branch develop --depth=1 https://github.com/ecmwf/eckit.git /src/eckit
-      - run: /buildscripts/compile.sh ./eckit/python_wrapper/buildconfig
-      - uses: actions/checkout@v2
-      - run: /buildscripts/compile.sh ./metkit/python_wrapper/buildconfig
-
-      ################################################################
-      - run: /buildscripts/wheel-linux.sh ./metkit/python_wrapper/buildconfig 3.11
-      - uses: actions/upload-artifact@v4
-        name: Upload wheel 3.11
-        with:
-          name: wheel-manylinux2_28-3.11
-          path: /build/wheel/*.whl
-
-      # TODO other python versions, once the above is correct.
-      # NOTE if Matrix, then break into (compile & upload) ; (wheel & upload)[matix] steps
-
-  test:
-
-    needs: build
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ["3.11"] # ["3.8", "3.9", "3.10", "3.11", "3.12"] # TODO enable
-
-    name: Test with ${{ matrix.python-version }}
     runs-on: [self-hosted, Linux, platform-builder-Rocky-8.6]
-    container: wheelmaker_2_28:0.1
+    # TODO which manylinux do we want to build for? 2014? 2_28? 2_34? Matrix?
+    container:
+      image: eccr.ecmwf.int/wheelmaker/2_28:0.10
+      credentials:
+        username: ${{ secrets.ECMWF_DOCKER_REGISTRY_USERNAME }}
+        password: ${{ secrets.ECMWF_DOCKER_REGISTRY_ACCESS_TOKEN }}
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/download-artifact@v4
-        with:
-          name: wheel-manylinux2_28-${{ matrix.python-version }}
-      - run: /buildscripts/test-wheel.sh ${{ matrix.python-version }}
-
-# TODO enable and test
-#  deploy:
-#
-#    if: ${{ github.ref_type == 'tag' || github.event_name == 'release' }}
-#    needs: [test, build]
-#    strategy:
-#      fail-fast: false
-#      matrix:
-#        python-version: ["3.11"] # ["3.8", "3.9", "3.10", "3.11", "3.12"] # TODO enable
-#
-#    name: Deploy wheel ${{ matrix.python-version }}
-#    runs-on: [self-hosted, Linux, platform-builder-Rocky-8.6]
-#    container: wheelmaker_2_28:0.1
-#    steps:
-#      - run: mkdir artifact-${{ matrix.python-version }}
-#      - uses: actions/checkout@v2
-#      - uses: actions/download-artifact@v4
-#        with:
-#          name: wheel-manylinux2_28-${{ matrix.python-version }}
-#          path: artifact-${{ matrix.python-version }}
-#      - run: |
-#      		/buildsripts/upload-twine.sh ${{ matrix.python-version }}
-#        env:
-#          TWINE_USERNAME: __token__
-#          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        # TODO convert this to be matrix-friendly. Note it's a bit tricky since
+        # we'd ideally not reexecute the compile step multiple times, but it
+        # (non-essentially) depends on a matrix-based step
+        # NOTE we dont use action checkout because it doesnt cleanup after itself correctly
+      - run: git clone --depth=1 --branch="${GITHUB_REF#refs/heads/}" https://github.com/$GITHUB_REPOSITORY /proj
+      - run: cd /proj && /buildscripts/prepare_deps.sh ./python_wrapper/buildconfig 3.11
+      - run: cd /proj && /buildscripts/compile.sh ./python_wrapper/buildconfig
+      - run: cd /proj && PYTHONPATH=/buildscripts /buildscripts/wheel-linux.sh ./python_wrapper/buildconfig 3.11
+      - run: cd /proj && /buildscripts/test-wheel.sh ./python_wrapper/buildconfig 3.11 /tmp/build/wheel/*whl
+      - run: cd /proj && /buildscripts/upload-pypi.sh /tmp/build/wheel/*whl
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        # NOTE temporary thing until all the mess gets cleared
+      - run: rm -rf ./* ./.git ./.github
diff --git a/python_wrapper/buildconfig b/python_wrapper/buildconfig
index e4fe118..e8470d8 100644
--- a/python_wrapper/buildconfig
+++ b/python_wrapper/buildconfig
@@ -8,7 +8,9 @@
 
 # to be source'd by wheelmaker's compile.sh *and* wheel-linux.sh
 # NOTE replace the whole thing with pyproject.toml? Less powerful, and quaint to use for sourcing ecbuild invocation
+# TODO we duplicate information -- pyproject.toml's `name` and `packages` are derivable from $NAME and must stay consistent
 
 NAME="metkit"
-CMAKE_PARAMS="-DECKIT_PATH=/target/eckit"
+CMAKE_PARAMS="-DECKIT_PATH=/tmp/target/eckit"
 PYPROJECT_DIR="python_wrapper"
+DEPENDENCIES='["eckit"]'