diff --git a/.github/workflows/tailscale-rdesktop.yml b/.github/workflows/tailscale-rdesktop.yml
index 393adf0..197ce1b 100644
--- a/.github/workflows/tailscale-rdesktop.yml
+++ b/.github/workflows/tailscale-rdesktop.yml
@@ -5,39 +5,24 @@ on:
 jobs:
   rdesktop-test:
     runs-on: ubuntu-24.04
-    container:
-      image: ghcr.io/gbraad-devenv/fedora/rdesktop:41
-      volumes:
-        - workspace:/workspace
-      options: --cpus 1
     
     steps:
-      - name: Tailscale setup (root)
+      - name: Run system container with `podman`
         run: |
-          sudo dnf update -y tailscale
-          sudo sed -i 's|--state=/var/lib/tailscale/tailscaled.state|--state=mem:|' /etc/init.d/tailscaled
-          sudo sed -i 's|--socket=/run/tailscale/tailscaled.sock|--socket=/var/run/tailscale/tailscaled.sock|' /etc/init.d/tailscaled
-          sudo sed -i '/--port 41641/ s/$/\n                --tun=userspace-networking \\/' /etc/init.d/tailscaled
-      - name: Tailscale setup (user)
+          podman run -d --name rdesktop ghcr.io/gbraad-devenv/fedora/rdesktop:41
+      - name: Tailscale setup (root)
         run: |
-          sudo chmod o+w /var/run/tailscale/
-          /etc/init.d/tailscaled start
-          until tailscale up
+          until podman exec rdesktop tailscale up --auth-key ${TAILSCALE_AUTHKEY}
           do
               sleep 0.1
           done
-          tailscale set --hostname github-${HOSTNAME}
+          podman exec rdesktop tailscale set --ssh
+          podman exec rdesktop tailscale set --hostname github-${HOSTNAME}
         env:
           TAILSCALE_AUTHKEY: ${{ secrets.TAILSCALE_AUTHKEY}}
-      - name: Prepare VNC server environment
-        run: |
-          su - gbraad -c 'echo "passwd\npasswd\n" | kasmvncpasswd -u gbraad -w'
-          su - gbraad -c 'touch ~/.vnc/.de-was-selected'
-      - name: Start `kasmvncserver`
-        run: |
-          su - gbraad -c 'kasmvncserver'
       - name: Hang around
         run: |
-          whoami
-          tailscale ip
-          sleep infinity
+          sleep 5
+          podman exec rdesktop systemctl is-active kasmvncserver
+          podman exec rdesktop tailscale ip
+          sleep infinity
\ No newline at end of file
diff --git a/assets/kasmvncserver.service b/assets/kasmvncserver.service
new file mode 100644
index 0000000..a64a5b5
--- /dev/null
+++ b/assets/kasmvncserver.service
@@ -0,0 +1,16 @@
+[Unit]
+Description=KasmVNC service
+After=network.target
+
+[Service]
+Type=forking
+WorkingDirectory=/home/gbraad
+User=gbraad
+Group=gbraad
+
+ExecStartPre=/bin/sh -c '/usr/bin/kasmvncserver -kill :1 > /dev/null 2>&1 || :'
+ExecStart=/usr/bin/kasmvncserver :1
+ExecStop=/usr/bin/kasmvncserver -kill :1
+
+[Install]
+WantedBy=multi-user.target
\ No newline at end of file
diff --git a/scripts/tailscaled b/assets/tailscaled
old mode 100755
new mode 100644
similarity index 100%
rename from scripts/tailscaled
rename to assets/tailscaled
diff --git a/containers/Containerfile-base b/containers/Containerfile-base
index 85f40f1..6d5729b 100644
--- a/containers/Containerfile-base
+++ b/containers/Containerfile-base
@@ -25,7 +25,7 @@ RUN dnf config-manager addrepo --from-repofile=https://pkgs.tailscale.com/stable
     && rm -rf /var/cache/yum \
     && mkdir -p /var/run/tailscale /var/cache/tailscale /var/lib/tailscale
 
-COPY scripts/tailscaled /etc/init.d/tailscaled
+COPY assets/tailscaled /etc/init.d/tailscaled
 
 # install cloudflared
 #RUN dnf install -y \
@@ -52,7 +52,8 @@ RUN dnf install -y \
         python3-pip \
         python3-pygments \
     && dnf clean all \
-    && rm -rf /var/cache/yum
+    && rm -rf /var/cache/yum \
+    && pip install ipykernel
     
 # ranger
 RUN dnf install -y \
@@ -84,6 +85,4 @@ RUN dnf config-manager addrepo --from-repofile=https://cli.github.com/packages/r
     && dnf clean all \
     && rm -rf /var/cache/yum
 
-USER gbraad
-
-RUN pip install pygments-style-tomorrownightbright
+USER gbraad
\ No newline at end of file
diff --git a/containers/Containerfile-dotfiles b/containers/Containerfile-dotfiles
index 9ceff1b..98e2812 100644
--- a/containers/Containerfile-dotfiles
+++ b/containers/Containerfile-dotfiles
@@ -4,7 +4,11 @@ FROM ghcr.io/gbraad-devenv/fedora/base:${BASE_VERSION}
 
 LABEL org.opencontainers.image.source = "https://github.com/gbraad-devenv/fedora"
 
+USER gbraad
+
 RUN git clone https://github.com/gbraad/dotfiles ~/.dotfiles \
     && ~/.dotfiles/install.sh
 
+RUN pip install pygments-style-tomorrownightbright
+
 ENTRYPOINT [ "/bin/zsh" ]
diff --git a/containers/Containerfile-rdesktop b/containers/Containerfile-rdesktop
index f83b86e..689f20b 100644
--- a/containers/Containerfile-rdesktop
+++ b/containers/Containerfile-rdesktop
@@ -29,15 +29,21 @@ RUN dnf install -y https://github.com/spotsnel/AltRPMS-KasmVNC/releases/download
     && rm -rf /var/cache/yum \
     && usermod -a -G kasmvnc-cert gbraad
 
+COPY assets/kasmvncserver.service /etc/systemd/system
+
 RUN sed -i 's/^FLAGS=".*"/FLAGS="--tun=userspace-networking"/' /etc/default/tailscaled
 
 USER gbraad
 
 RUN mkdir -p ~/.vnc \
-    && echo '#!/bin/sh' > ~/.vnc/xstartup \
-    && echo 'i3 &' >> ~/.vnc/xstartup \
-    && chmod +x ~/.vnc/xstartup
+    && echo $'#!/bin/sh\ni3 &' > ~/.vnc/xstartup \
+    && chmod +x ~/.vnc/xstartup \
+    && /bin/bash -c "echo -e 'password\npassword\n\n' | kasmvncpasswd -u gbraad -w" \
+    && touch ~/.vnc/.de-was-selected    
 
 # systemd is already set up in systemd image; make sure to use root
 USER root
+
+RUN systemctl enable kasmvncserver
+
 #ENTRYPOINT ["/sbin/init"]
diff --git a/github/install.sh b/github/install.sh
index d79c25e..2f28ad0 100755
--- a/github/install.sh
+++ b/github/install.sh
@@ -8,7 +8,4 @@ git init /workspaces/fedora
 
 cd ~
 
-# additional files
-pip install ipykernel
-
 exit 0