We also need to do something similar for an air-gapped device. I.e build a patch in CI and then copy the patch across and apply it on a device that is fully offline.