diff --git a/.github/workflows/force-rebuild.yml b/.github/workflows/force-rebuild.yml
new file mode 100644
index 0000000..f57d077
--- /dev/null
+++ b/.github/workflows/force-rebuild.yml
@@ -0,0 +1,53 @@
+name: Force rebuild
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Every Wednesday at 05:00 UTC (all US time zones asleep)
+    - cron: "0 5 * * 3"
+
+permissions:
+  contents: read
+
+jobs:
+  force-rebuild:
+    runs-on: ubuntu-24.04
+    env:
+      GH_TOKEN: ${{ secrets.SCHUTZBOT_GITHUB_ACCESS_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          token: ${{ secrets.SCHUTZBOT_GITHUB_ACCESS_TOKEN }}
+
+      - name: Configure git user
+        run: |
+          git config user.name "schutzbot"
+          git config user.email "schutzbot@gmail.com"
+
+      - name: Bump rebuild timestamp
+        id: bump
+        run: |
+          timestamp=$(python3 schutzbot/bump_rebuild_timestamp.py)
+          echo "timestamp=${timestamp}" >> "$GITHUB_OUTPUT"
+
+      - name: Open PR
+        run: |
+          if git diff --quiet; then echo "No changes"; exit 0; fi
+          timestamp="${{ steps.bump.outputs.timestamp }}"
+          branch="force-rebuild-${timestamp}"
+          git checkout -b "${branch}"
+          git add Schutzfile
+          git commit -m "schutzfile: force rebuild ${timestamp}"
+          git push -f origin "${branch}"
+          existing_pr=$(gh pr list --head "${branch}" --state open --json number --jq '.[0].number')
+          if [ -n "$existing_pr" ]; then
+            echo "PR #${existing_pr} already exists for branch ${branch}; skipping."
+            exit 0
+          fi
+          gh pr create \
+            --title "Force rebuild ${timestamp}" \
+            --body "Periodic forced rebuild to trigger full CI testing and Konflux pipeline rebuilds." \
+            --base "main" \
+            --head "${branch}"
diff --git a/Schutzfile b/Schutzfile
index 44119cb..d787398 100644
--- a/Schutzfile
+++ b/Schutzfile
@@ -1,5 +1,6 @@
 {
   "common": {
+    "last-forced-rebuild": "000000000000",
     "dependencies": {
       "images": {
         "ref": "dac29a33b6d4b830baa6134bd9e4e7256e786d27"
diff --git a/schutzbot/bump_rebuild_timestamp.py b/schutzbot/bump_rebuild_timestamp.py
new file mode 100755
index 0000000..3b28a7a
--- /dev/null
+++ b/schutzbot/bump_rebuild_timestamp.py
@@ -0,0 +1,29 @@
+#!/usr/bin/env python3
+import json
+from datetime import datetime, timezone
+
+# Relative to repo root; must be run from the repo top-level directory.
+SCHUTZFILE = "Schutzfile"
+
+
+def bump_rebuild_timestamp():
+    with open(SCHUTZFILE, encoding="utf-8") as f:
+        data = json.load(f)
+
+    timestamp = datetime.now(timezone.utc).strftime("%Y%m%d%H%M")
+    data["common"]["last-forced-rebuild"] = timestamp
+
+    with open(SCHUTZFILE, encoding="utf-8", mode="w") as f:
+        json.dump(data, f, indent=2)
+        f.write("\n")
+
+    return timestamp
+
+
+def main():
+    timestamp = bump_rebuild_timestamp()
+    print(timestamp)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/stream10-installer b/stream10-installer
index b446ede..00243c3 100644
--- a/stream10-installer
+++ b/stream10-installer
@@ -6,6 +6,21 @@ FROM quay.io/centos-bootc/centos-bootc:stream10
 
 ARG TARGETARCH
 
+# NOTE: bootc containers are shipped with empty /boot. While these images are created,
+# /boot is moved to /usr/lib/bootupd/updates by bootupd. When bootc install is
+# run to create a disk image, it calls bootupd that unpacks /usr/lib/bootupd/updates
+# back into /boot/efi.
+#
+# For the installer ISO image, we need the /boot to be populated, to fulfill the
+# container-native ISO contract (https://github.com/ondrejbudai/bootc-isos#container-native-iso-contract-v010).
+#
+# Reinstall shim-x64 to ensure that required files are not missing from /boot/efi/EFI
+#
+# This will have to change later due to https://fedoraproject.org/wiki/Changes/BootLoaderUpdatesPhase1
+RUN dnf reinstall -y \
+    shim-x64 \
+    && dnf clean all
+
 # Packages needed for Anaconda; and build dependencies
 RUN dnf install -y \
     anaconda \
@@ -24,8 +39,10 @@ RUN dnf install -y \
     fuse-overlayfs \
     && dnf clean all
 
-RUN mkdir -p /boot/efi \
-    && cp -rva /usr/lib/efi/*/*/EFI /boot/efi
+# NOTE: This stopped working on the latest c10s images, because nothing is installing to /usr/lib/efi/*/*/EFI
+# shim-x64 is still installing to /boot/efi as of shim-x64-16.1-1.el10.x86_64. See the section above for more details.
+# RUN mkdir -p /boot/efi \
+#     && cp -rva /usr/lib/efi/*/*/EFI /boot/efi
 
 
 RUN mkdir -p /usr/lib/image-builder/bootc