diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 471b9990..fbe422a1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -186,9 +186,11 @@ jobs:
               cargo zigbuild ${MAYBE_LTO:-} --all --release ${TARGETS} --no-default-features ${FEATURES}
             for b in ${binaries[@]}; do
               mkdir -p "binaries/${b}/"
-              echo Copying ${b}
+              echo Packaging ${b}
               for t in ${targets[@]}; do
-                cp -L target/${t}-unknown-linux-gnu/release/${b} binaries/${b}/${t}-${f}
+                nix develop -c \
+                  cargo deb --no-build --no-strip -p ${b} --target ${t}-unknown-linux-gnu -o binaries/${b}/${b}_${f}_${t}.deb
+                cp -L target/${t}-unknown-linux-gnu/release/${b} binaries/${b}/${b}_${f}_${t}
               done
             done
           done
@@ -203,7 +205,7 @@ jobs:
             # We make sure that the tarball is idempotent:
             # https://stackoverflow.com/a/54908072
             tar --sort=name --owner=root:0 --group=root:0 --mtime='@0' \
-              -vhcf artifacts/${b}.tar.zst -C binaries/${b} .
+              -vahcf artifacts/${b}.tar.zst -C binaries/${b} .
           done
           ls -aRsh artifacts
 
diff --git a/flake.nix b/flake.nix
index 295cf1de..c30f2f98 100644
--- a/flake.nix
+++ b/flake.nix
@@ -83,6 +83,9 @@
               zig
               cargo-zigbuild
 
+              # Needed for packaging for orb-os
+              cargo-deb
+
               # Used by various rust build scripts to find system libs
               # Note that this is the unwrapped version of pkg-config. By default,
               # nix wraps pkg-config with a script that replaces the PKG_CONFIG_PATH
diff --git a/orb-attest/Cargo.toml b/orb-attest/Cargo.toml
index e18311a1..d6b9b029 100644
--- a/orb-attest/Cargo.toml
+++ b/orb-attest/Cargo.toml
@@ -55,6 +55,5 @@ prod = [] # use prod backend
 [package.metadata.deb]
 maintainer-scripts = "debian/"
 systemd-units = [
-  { unit-name = "worldcoin-token" },
-  { unit-name = "worldcoin-token-dumb-client" }
+  { unit-name = "worldcoin-attest" },
 ]
diff --git a/orb-attest/debian/orb-token.worldcoin-token.service b/orb-attest/debian/orb-attest.worldcoin-attest.service
similarity index 89%
rename from orb-attest/debian/orb-token.worldcoin-token.service
rename to orb-attest/debian/orb-attest.worldcoin-attest.service
index 68721519..c3db0b01 100644
--- a/orb-attest/debian/orb-token.worldcoin-token.service
+++ b/orb-attest/debian/orb-attest.worldcoin-attest.service
@@ -1,5 +1,5 @@
 [Unit]
-Description=Short lived token daemon
+Description=Short lived attestation token daemon
 ## persistent contains SE pairing keys
 After=usr-persistent.mount
 Requires=worldcoin-backend-online.target