diff --git a/compile.sh b/compile.sh
index f5628091e..a748fb562 100755
--- a/compile.sh
+++ b/compile.sh
@@ -44,7 +44,7 @@ logging_init
 traps_init
 
 # make sure git considers our build system dir as a safe dir (only if actually building)
-[[ "${CONFIG_DEFS_ONLY}" != "yes" ]] && git_ensure_safe_directory "${SRC}"
+[[ "${CONFIG_DEFS_ONLY}" != "yes" && "${PRE_PREPARED_HOST}" != "yes" ]] && git_ensure_safe_directory "${SRC}"
 
 # Execute the main CLI entrypoint.
 cli_entrypoint "$@"
diff --git a/lib/functions/cli/cli-artifact.sh b/lib/functions/cli/cli-artifact.sh
index 6b51801dd..dd9dd05a9 100644
--- a/lib/functions/cli/cli-artifact.sh
+++ b/lib/functions/cli/cli-artifact.sh
@@ -8,6 +8,13 @@
 # https://github.com/armbian/build/
 
 function cli_artifact_pre_run() {
+	case "${ARMBIAN_COMMAND}" in
+		download-artifact)
+			display_alert "download-only mode:" "won't build '${WHAT}'" "info"
+			DONT_BUILD_ARTIFACTS="${WHAT}"
+			;;
+	esac
+
 	initialize_artifact "${WHAT}"
 	# Run the pre run adapter
 	artifact_cli_adapter_pre_run
@@ -45,31 +52,45 @@ function cli_artifact_run() {
 	declare ignore_local_cache="${ignore_local_cache:-"${default_update_remote_only}"}"
 	declare deploy_to_remote="${deploy_to_remote:-"${default_update_remote_only}"}"
 
-	# If OCI_TARGET_BASE is explicitly set, ignore local, skip if found in remote, and deploy to remote after build.
-	if [[ -n "${OCI_TARGET_BASE}" ]]; then
-		skip_unpack_if_found_in_caches="yes"
-		ignore_local_cache="yes"
-		deploy_to_remote="yes"
-
-		# Pass ARTIFACT_USE_CACHE=yes to actually use the cache versions, but don't deploy to remote.
-		# @TODO this is confusing. each op should be individually controlled...
-		# what we want is:
-		# 1: - check remote, if not found, check local, if not found, build, then deploy to remote
-		#      - if remote found, do nothing.
-		#      - if local found, deploy it to remote (for switching targets)
-		# 2: - get from remote -> get local -> build, then DON'T deploy to remote
-		if [[ "${ARTIFACT_USE_CACHE}" == "yes" ]]; then
+	case "${ARMBIAN_COMMAND}" in
+		download-artifact)
+			display_alert "Running in download-artifact mode" "download-artifact" "ext"
 			skip_unpack_if_found_in_caches="no"
 			ignore_local_cache="no"
 			deploy_to_remote="no"
-		fi
-	fi
+			;;
+		*)
+			# @TODO: rpardini: i'm braindead. I really can't make sense of my own code!
+			# If OCI_TARGET_BASE is explicitly set, ignore local, skip if found in remote, and deploy to remote after build.
+			if [[ -n "${OCI_TARGET_BASE}" ]]; then
+				skip_unpack_if_found_in_caches="yes"
+				ignore_local_cache="yes"
+				deploy_to_remote="yes"
+
+				# Pass ARTIFACT_USE_CACHE=yes to actually use the cache versions, but don't deploy to remote.
+				# @TODO this is confusing. each op should be individually controlled...
+				# what we want is:
+				# 1: - check remote, if not found, check local, if not found, build, then deploy to remote
+				#      - if remote found, do nothing.
+				#      - if local found, deploy it to remote (for switching targets)
+				# 2: - get from remote -> get local -> build, then DON'T deploy to remote
+				if [[ "${ARTIFACT_USE_CACHE}" == "yes" ]]; then
+					skip_unpack_if_found_in_caches="no"
+					ignore_local_cache="no"
+					deploy_to_remote="no"
+				fi
+			fi
+			;;
+	esac
 
 	# Force artifacts download we need to populate repository
 	if [[ "${FORCE_ARTIFACTS_DOWNLOAD}" == "yes" ]]; then
 		skip_unpack_if_found_in_caches="no"
 	fi
 
+	# display a summary of the 3 vars above: skip_unpack_if_found_in_caches, ignore_local_cache, deploy_to_remote
+	display_alert "CLI Artifact summary" "skip_unpack_if_found_in_caches=${skip_unpack_if_found_in_caches}, ignore_local_cache=${ignore_local_cache}, deploy_to_remote=${deploy_to_remote}" "info"
+
 	if [[ "${ARTIFACT_BUILD_INTERACTIVE}" == "yes" ]]; then # Set by `kernel-config`, `kernel-patch`, `uboot-config`, `uboot-patch`, etc.
 		display_alert "Running artifact build in interactive mode" "log file will be incomplete" "info"
 		do_with_default_build obtain_complete_artifact
diff --git a/lib/functions/cli/commands.sh b/lib/functions/cli/commands.sh
index 6f561d508..a7edf8586 100644
--- a/lib/functions/cli/commands.sh
+++ b/lib/functions/cli/commands.sh
@@ -43,6 +43,7 @@ function armbian_register_commands() {
 		# all-around artifact wrapper
 		["artifact"]="artifact"                  # implemented in cli_artifact_pre_run and cli_artifact_run
 		["artifact-config-dump-json"]="artifact" # implemented in cli_artifact_pre_run and cli_artifact_run
+		["download-artifact"]="artifact"         # implemented in cli_artifact_pre_run and cli_artifact_run
 
 		# shortcuts, see vars set below. the use legacy single build, and try to control it via variables
 		["rootfs"]="artifact"