diff --git a/.woodpecker.yml b/.woodpecker.yml
index a6c96dc..4cebe34 100644
--- a/.woodpecker.yml
+++ b/.woodpecker.yml
@@ -31,7 +31,7 @@ steps:
           kubernetes.io/arch: amd64
     commands:
       - sh ci/setup.sh
-      - xonsh ci/build.xsh x86_64-linux
+      - python3 ci/build.py x86_64-linux
 
   - name: build-aarch64-linux
     image: git.oleks.space/oleks/nix-ci:latest
@@ -47,7 +47,7 @@ steps:
           kubernetes.io/arch: arm64
     commands:
       - sh ci/setup.sh
-      - xonsh ci/build.xsh aarch64-linux
+      - python3 ci/build.py aarch64-linux
 
   - name: build-s390x-linux
     image: git.oleks.space/oleks/nix-ci:latest
@@ -63,4 +63,4 @@ steps:
           kubernetes.io/arch: amd64
     commands:
       - sh ci/setup.sh
-      - xonsh ci/build.xsh s390x-linux
+      - python3 ci/build.py s390x-linux
diff --git a/ci/build.py b/ci/build.py
new file mode 100644
index 0000000..c835595
--- /dev/null
+++ b/ci/build.py
@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+"""Build all flake-hub packages and push to attic."""
+
+import os
+import subprocess
+import sys
+
+
+def run(cmd):
+    print(f"+ {cmd}", flush=True)
+    r = subprocess.run(cmd, shell=True)
+    if r.returncode != 0:
+        sys.exit(r.returncode)
+
+
+def capture(cmd):
+    r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
+    if r.returncode != 0:
+        print(r.stderr, file=sys.stderr)
+        sys.exit(r.returncode)
+    return r.stdout.strip()
+
+
+ARCH = sys.argv[1]
+ATTIC_CACHE = "attic-infra-cache-k3s-1"
+ATTIC_SERVER = "https://nix-cache-upload.oleks.space"
+ATTIC_TOKEN = os.environ["ATTIC_TOKEN"]
+
+print(f"=== Building flake-hub packages for {ARCH} ===")
+
+# Setup attic
+attic = capture("nix build --inputs-from . nixpkgs#attic-client --print-out-paths --no-link") + "/bin/attic"
+run(f"'{attic}' login ci {ATTIC_SERVER} '{ATTIC_TOKEN}'")
+
+# Packages per arch
+packages = ["hello-world", "geesefs", "xonsh"]
+if ARCH == "s390x-linux":
+    packages += ["attic-client"]
+
+print("Building packages...")
+for pkg in packages:
+    print(f"--- {pkg} ---")
+    out = capture(f"nix build '.#packages.{ARCH}.{pkg}' --print-build-logs --print-out-paths --no-link")
+    run(f"'{attic}' push {ATTIC_CACHE} {out}")
+
+print(f"Build completed for {ARCH}")
diff --git a/ci/build.xsh b/ci/build.xsh
deleted file mode 100644
index 78d8276..0000000
--- a/ci/build.xsh
+++ /dev/null
@@ -1,26 +0,0 @@
-#!/usr/bin/env xonsh
-"""Build all flake-hub packages and push to attic."""
-
-import sys
-
-ARCH = sys.argv[1]
-ATTIC_CACHE = "attic-infra-cache-k3s-1"
-ATTIC_SERVER = "https://nix-cache-upload.oleks.space"
-
-print(f"=== Building flake-hub packages for {ARCH} ===")
-
-# Setup attic
-attic = $(nix build --inputs-from . nixpkgs#attic-client --print-out-paths --no-link).strip() + "/bin/attic"
-@(attic) login ci @(ATTIC_SERVER) $ATTIC_TOKEN
-
-# Packages per arch
-_cross_only = {"s390x-linux": ["attic-client"]}
-packages = ["hello-world", "geesefs", "xonsh"] + _cross_only.get(ARCH, [])
-
-print("Building packages...")
-for pkg in packages:
-    print(f"--- {pkg} ---")
-    out = $(nix build @(f".#packages.{ARCH}.{pkg}") --print-build-logs --print-out-paths --no-link).strip()
-    @(attic) push @(ATTIC_CACHE) @(out)
-
-print(f"Build completed for {ARCH}")