diff --git a/.github/workflows/build-nightly.yml b/.github/workflows/build-nightly.yml
index e9ea966628..06186d3b0c 100644
--- a/.github/workflows/build-nightly.yml
+++ b/.github/workflows/build-nightly.yml
@@ -11,8 +11,7 @@ on:
         default: false
         type: boolean
   workflow_call:
-  pull_request:
-    types: [ assigned ]
+
 
 jobs:
   set-envs:
diff --git a/.github/workflows/build-self-hosted-device.yml b/.github/workflows/build-self-hosted-device.yml
new file mode 100644
index 0000000000..866155528f
--- /dev/null
+++ b/.github/workflows/build-self-hosted-device.yml
@@ -0,0 +1,63 @@
+name: Build self hosted devices
+
+on:
+  workflow_call:
+    inputs:
+      DEVICE:
+        required: true
+        type: string
+
+jobs:
+  Build:
+    runs-on: self-hosted
+    env:
+      CCACHE_DIR: $HOME/ccache-${{ inputs.DEVICE }}
+      CCACHE_SLOPPINESS: pch_defines,time_macros
+      SOURCES_DIR: /opt/rocknix-sources
+    steps:
+      - name: Fix permissions
+        run: |
+          chmod -R u+rwX $GITHUB_WORKSPACE/build.ROCKNIX-*.aarch64/build/syncthing-* || true
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Build
+        uses: corrupt952/actions-retry-command@v1.0.7
+        with:
+          command: |
+            CCACHE_DIR=$HOME/ccache-${{ inputs.DEVICE }} ccache --max-size=20G
+            CCACHE_DIR=$HOME/ccache-${{ inputs.DEVICE }} ccache --set-config sloppiness=pch_defines,time_macros
+            set -o pipefail
+            make ${{ inputs.DEVICE }} | tee output.log | grep -E --color=never --line-buffered "^GET|^UNPACK|^BUILD|^INSTALL"
+            exit ${PIPESTATUS[0]}
+          max_attempts: 4
+          retry_interval: 10
+
+      - name: Archive output.logs (${{ inputs.DEVICE }}-aarch64)
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: output.logs-${{ inputs.DEVICE }}-aarch64
+          path: |
+            output.log
+            ./build.ROCKNIX-${{ inputs.DEVICE }}.aarch64/.threads/logs/
+      - name: Get date
+        run: echo "DATE=$(date +'%Y%m%d')" >> $GITHUB_ENV
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ROCKNIX-image-${{ inputs.DEVICE }}-${{ env.DATE }}
+          path: |
+            target/ROCKNIX-*.img.gz
+            target/ROCKNIX-*.img.gz.sha256
+          compression-level: 0
+          if-no-files-found: error
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ROCKNIX-update-${{ inputs.DEVICE }}-${{ env.DATE }}
+          path: |
+            target/ROCKNIX-*.tar
+            target/ROCKNIX-*.tar.sha256
+          compression-level: 0
+          if-no-files-found: error
diff --git a/.github/workflows/build-self-hosted.yml b/.github/workflows/build-self-hosted.yml
new file mode 100644
index 0000000000..254f5327a9
--- /dev/null
+++ b/.github/workflows/build-self-hosted.yml
@@ -0,0 +1,36 @@
+name: Build self-hosted
+
+on:
+  workflow_dispatch:
+  workflow_call:
+  pull_request:
+    types: [ assigned ]
+
+jobs:
+  require-approval:
+    runs-on: ubuntu-24.04
+    environment:
+      name: ${{ github.event_name == 'pull_request' && 'pr-approval' || 'auto' }}
+    steps:
+      - run: echo "PR approved"
+  build-devices:
+    name: Build Devices
+    needs: require-approval
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - device: RK3326
+          - device: RK3399
+          - device: RK3566
+          - device: RK3588
+          - device: S922X
+          - device: H700
+          - device: SDM845
+          - device: SM8250
+          - device: SM8550
+          - device: SM8650
+    uses: ./.github/workflows/build-self-hosted-device.yml
+    secrets: inherit
+    with:
+      DEVICE: ${{ matrix.device }}
\ No newline at end of file