diff --git a/internal/imagecat/catalog.json b/internal/imagecat/catalog.json
index 7f19696..07c5e11 100644
--- a/internal/imagecat/catalog.json
+++ b/internal/imagecat/catalog.json
@@ -1,4 +1,14 @@
 {
   "version": 1,
-  "entries": []
+  "entries": [
+    {
+      "name": "debian-bookworm",
+      "distro": "debian",
+      "arch": "x86_64",
+      "kernel_ref": "generic-6.12",
+      "tarball_url": "https://images.thaloco.com/debian-bookworm-x86_64.tar.zst",
+      "tarball_sha256": "071495e60e830d5a0b40bb7b227a40a81cc0631a99d79a4eae471166b0d69a53",
+      "size_bytes": 286026738
+    }
+  ]
 }
diff --git a/scripts/publish-golden-image.sh b/scripts/publish-golden-image.sh
index 8ca65b2..5636f9a 100755
--- a/scripts/publish-golden-image.sh
+++ b/scripts/publish-golden-image.sh
@@ -11,7 +11,7 @@
 #     [--size <spec>] [--platform <p>] [--skip-upload]
 #
 # Environment overrides:
-#   RCLONE_REMOTE   rclone remote to upload through (default: r2)
+#   RCLONE_REMOTE   rclone remote to upload through (default: banger-images)
 #   RCLONE_BUCKET   R2 bucket name                  (default: banger-images)
 #   BASE_URL        public URL prefix for the bucket (default: https://images.thaloco.com)
 
@@ -24,7 +24,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 CATALOG_FILE="$REPO_ROOT/internal/imagecat/catalog.json"
 
-RCLONE_REMOTE="${RCLONE_REMOTE:-r2}"
+RCLONE_REMOTE="${RCLONE_REMOTE:-banger-images}"
 RCLONE_BUCKET="${RCLONE_BUCKET:-banger-images}"
 BASE_URL="${BASE_URL:-https://images.thaloco.com}"
 
@@ -98,7 +98,14 @@ if [[ "$SKIP_UPLOAD" -eq 1 ]]; then
 fi
 
 log "uploading to $RCLONE_REMOTE:$RCLONE_BUCKET/$TARBALL_NAME"
-rclone copyto "$OUT" "$RCLONE_REMOTE:$RCLONE_BUCKET/$TARBALL_NAME"
+# --s3-no-check-bucket skips the HeadBucket preflight; --no-check-dest
+# skips the HeadObject preflight. Both fail with 403 on R2 tokens that
+# only have PutObject + GetObject but not Head* — a common scoped-token
+# setup.
+rclone copyto \
+  --s3-no-check-bucket \
+  --no-check-dest \
+  "$OUT" "$RCLONE_REMOTE:$RCLONE_BUCKET/$TARBALL_NAME"
 
 URL="$BASE_URL/$TARBALL_NAME"
 log "verifying $URL is reachable"