diff --git a/.github/workflows/build-webgl.yml b/.github/workflows/build-webgl.yml
index 41a36b5c..57d95635 100644
--- a/.github/workflows/build-webgl.yml
+++ b/.github/workflows/build-webgl.yml
@@ -1,104 +1,72 @@
 name: AIS Prototype Build
 
-# Controls when the action will run. Triggers the workflow on creation of 
-# tags.  Creating new 'versions' via github is the most straightforward 
-# way of doing this.
+# One Unity build, deployed independently to:
+#   - the Vault staging CDN: https://cdn.vaultlearninggames-staging.org/fielddaylab/ais-prototype/<branch>/
+#   - the DoIT server (legacy; delete the `doit` job when DoIT is retired)
+# The two deploys don't depend on each other. Deleting a branch removes its CDN preview.
 on:
    push:
+   delete:
    workflow_dispatch:
-  
+
 jobs:
   build:
-    name: Build Unity Project
+    if: github.event_name != 'delete'
+    uses: fielddaylab/vault-publisher/.github/workflows/unity-build.yml@v1
+    secrets: inherit
+
+  preview:
+    needs: build
+    permissions:
+      contents: read
+      id-token: write
+    uses: fielddaylab/vault-publisher/.github/workflows/publish-preview.yml@v1
+    with:
+      game: ais-prototype
+      artifact: ${{ needs.build.outputs.artifact }}
+
+  remove-preview:
+    if: github.event_name == 'delete'
+    permissions:
+      contents: read
+      id-token: write
+    uses: fielddaylab/vault-publisher/.github/workflows/publish-preview.yml@v1
+    with:
+      game: ais-prototype
+
+  # Legacy DoIT deploy: https://fielddaylab.wisc.edu/play/ais-prototype/ci/<branch>/
+  doit:
+    needs: build
     runs-on: ubuntu-latest
     concurrency:
-      group: ${{ github.workflow }}-${{ github.ref }}
+      group: doit-${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
-
-    # Setup Steps
-
     steps:
-    
-    - name: Free disk space
-      run: curl -fsSL https://raw.githubusercontent.com/kou/arrow/e49d8ae15583ceff03237571569099a6ad62be32/ci/scripts/util_free_space.sh | bash
-      
-    - name: Install OpenConnect
-      run: sudo NEEDRESTART_MODE=a sudo apt-get update && sudo apt-get install openconnect
-      
-    - name: Connect to VPN
-      run: echo ${{ secrets.FIELDDAY_VPN_PASSWORD }} | sudo openconnect --protocol=gp -u ${{ secrets.FIELDDAY_VPN_USERNAME }} --passwd-on-stdin soe.vpn.wisc.edu &
-      
-    - name: Checkout repository
-      uses: actions/checkout@v4
+    - name: Download build
+      uses: actions/download-artifact@v8
       with:
-        lfs: true
-      
-    - name: Checkout submodules
-      uses: srt32/git-actions@v0.0.3
-      with:
-        args:  |
-          git config --global --add safe.directory "/github/workspace"
-          git config --global --add safe.directory "/github/workspace/Submodules"
-          git submodule update --init --recursive
-
-    # Extracts branch name into BRANCH environment variable
-    - name: Extract branch name
-      shell: bash
-      run: echo "BRANCH=$(echo ${GITHUB_REF#refs/heads/} | sed 's/\//_/g')" >> $GITHUB_ENV
+        name: ${{ needs.build.outputs.artifact }}
+        path: build
 
-    # Extracts version tag into VERSION environment variable
-    - name: Extract version name
-      shell: bash
-      run: echo "VERSION=$(echo ${GITHUB_REF#refs/tags/} | sed 's/\//_/g')" >> $GITHUB_ENV
+    - name: Install OpenConnect
+      run: sudo NEEDRESTART_MODE=a apt-get -q update && sudo NEEDRESTART_MODE=a apt-get -q install -y openconnect
 
-    # Read editor version
-    - name: Retrieve editor version
-      id: getEditorVersion
-      uses: pietrobolcato/action-read-yaml@1.1.0
-      with:
-        config: ${{ github.workspace }}/ProjectSettings/ProjectVersion.txt
+    - name: Connect to VPN
+      run: |
+        echo "${{ secrets.FIELDDAY_VPN_PASSWORD }}" | sudo openconnect --protocol=gp -u "${{ secrets.FIELDDAY_VPN_USERNAME }}" --passwd-on-stdin --background soe.vpn.wisc.edu
+        # Wait for the tunnel before uploading.
+        for _ in $(seq 1 30); do ip link show tun0 > /dev/null 2>&1 && exit 0; sleep 2; done
+        echo "::error::VPN tunnel did not come up"; exit 1
 
-    - name: Extract editor version to var
-      shell: bash
-      run: echo "UNITY_VERSION=${{ steps.getEditorVersion.outputs['m_EditorVersion'] }}" >> $GITHUB_ENV
-      
-    # Unity Build Steps
+    - name: Branch folder name
+      run: echo "BRANCH=$(echo "${GITHUB_REF#refs/heads/}" | sed 's/\//_/g')" >> "$GITHUB_ENV"
 
-    - name: Cache Library folder
-      uses: actions/cache@v3
-      with:
-        path: Library
-        key: Library
-    
-    # Build
-    - name: Build project
-      uses: game-ci/unity-builder@v4
-      env:
-        UNITY_EMAIL: ${{ secrets.UNITY_EMAIL }}
-        UNITY_PASSWORD: ${{ secrets.UNITY_PASSWORD }}
-        UNITY_SERIAL: ${{ secrets.UNITY_SERIAL }}
-      with:
-        unityVersion: ${{ env.UNITY_VERSION }}
-        targetPlatform: WebGL
-        #customParameters: '-myParameter myValue -myBoolean -ThirdParameter andItsValue'
-    
-    
-    # Deploy Steps
-    
-    - name: Upload build as artifact
-      uses: actions/upload-artifact@v4
-      with:
-        name: ${{ github.event.repository.name }}-webgl_${{ env.VERSION }}
-        path: build/WebGL/WebGL/
-        overwrite: true
-    
     - name: Upload to web server via rsync
       uses: burnett01/rsync-deployments@5.2
       with:
         switches: -avzr --delete --rsync-path="mkdir -p ${{ secrets.DEPLOY_DIR }}/${{ env.BRANCH }} && rsync"
-        path: build/WebGL/WebGL/*
+        path: build/*
         remote_path: ${{ secrets.DEPLOY_DIR }}/${{ env.BRANCH }}
         remote_host: ${{ secrets.FIELDDAY_WISC_EDU_DEPLOY_HOST }}
         remote_user: ${{ secrets.FIELDDAY_WISC_EDU_DEPLOY_USER }}
         remote_key: ${{ secrets.FIELDDAY_WISC_EDU_DEPLOY_KEY }}
-    
\ No newline at end of file