diff --git a/Makefile b/Makefile
index 0793489..d6e9cd3 100644
--- a/Makefile
+++ b/Makefile
@@ -66,6 +66,12 @@ restic-env: $(apps_config) make-restic-generated.sh
 restic-password: $(apps_config) make-restic-password.sh
 	./make-restic-password.sh $(apps_config) > restic-password
 
+app.tar.gz: app/.dirstamp \
+app/.env \
+app/lb/lb.env \
+app/lb/Caddyfile
+	tar cfz app.tar.gz app/
+
 ignition.json: cl.yaml app/.dirstamp \
 $(IMAGE_DEPS) \
 app/lb/lb.env \
@@ -75,7 +81,8 @@ restic-password \
 restic-restore.sh \
 restic-snapshot.sh \
 app/.env \
-$(config_dir)ssh-keys
+$(config_dir)ssh-keys \
+app.tar.gz
 	cat cl.yaml | docker run --rm --volume $(config_dir)/ssh-keys:/pwd/ssh-keys --volume ${PWD}:/pwd --workdir /pwd -i quay.io/coreos/butane:latest -d /pwd > ignition.json
 
 generated.tfvars: $(apps_config) make-generated.sh
diff --git a/cl.yaml b/cl.yaml
index 50dfcea..a52c938 100644
--- a/cl.yaml
+++ b/cl.yaml
@@ -80,6 +80,18 @@ systemd:
         [Install]
         WantedBy=multi-user.target
 
+    - name: unpack-app.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Unpack /app
+        Before=app.service
+        [Service]
+        Type=oneshot
+        ExecStart=/unpack-app
+        [Install]
+        WantedBy=multi-user.target
+
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - name: systemd-sysupdate.timer
@@ -117,10 +129,14 @@ storage:
     - device: /dev/disk/by-partlabel/appstorage
       format: ext4
       wipe_filesystem: false
-  trees:
-    - path: /app
-      local: app
+  # trees:
+  #   - path: /app
+  #     local: app
   files:
+    - path: /app.tar.gz
+      mode: 0600
+      contents:
+        local: app.tar.gz
     - path: /restic-password
       contents:
         local: restic-password
@@ -143,6 +159,15 @@ storage:
         inline: |
           PermitRootLogin no
           AllowUsers core
+    - path: /unpack-app
+      mode: 0755
+      contents:
+        inline: |
+          #!/bin/sh
+          set -e
+          mkdir /app
+          tar -xzf /app.tar.gz -C /
+          rm /app.tar.gz
     ### docker-compose sysext
     ### https://flatcar.github.io/sysext-bakery/docker_compose/
     - path: /opt/extensions/docker-compose/docker-compose-5.1.4-x86-64.raw