diff --git a/iso/builder/build-debug.sh b/iso/builder/build-debug.sh
index d68a1d4..6db3317 100644
--- a/iso/builder/build-debug.sh
+++ b/iso/builder/build-debug.sh
@@ -33,15 +33,27 @@ echo "Alpine: ${ALPINE_VERSION}, Go: ${GO_VERSION}"
 echo ""
 
 # --- compile audit binary (static, Linux amd64) ---
-echo "=== building audit binary ==="
-cd "${REPO_ROOT}/audit"
-GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
-    go build \
-    -ldflags "-s -w -X main.Version=debug-$(date +%Y%m%d)" \
-    -o "${DIST_DIR}/bee-audit-linux-amd64" \
-    ./cmd/audit
-echo "binary: ${DIST_DIR}/bee-audit-linux-amd64"
-echo "size:   $(du -sh "${DIST_DIR}/bee-audit-linux-amd64" | cut -f1)"
+# Skip rebuild if binary is newer than all Go source files.
+AUDIT_BIN="${DIST_DIR}/bee-audit-linux-amd64"
+NEED_BUILD=1
+if [ -f "$AUDIT_BIN" ]; then
+    NEWEST_SRC=$(find "${REPO_ROOT}/audit" -name '*.go' -newer "$AUDIT_BIN" | head -1)
+    [ -z "$NEWEST_SRC" ] && NEED_BUILD=0
+fi
+
+if [ "$NEED_BUILD" = "1" ]; then
+    echo "=== building audit binary ==="
+    cd "${REPO_ROOT}/audit"
+    GOOS=linux GOARCH=amd64 CGO_ENABLED=0 \
+        go build \
+        -ldflags "-s -w -X main.Version=debug-$(date +%Y%m%d)" \
+        -o "$AUDIT_BIN" \
+        ./cmd/audit
+    echo "binary: $AUDIT_BIN"
+    echo "size:   $(du -sh "$AUDIT_BIN" | cut -f1)"
+else
+    echo "=== audit binary up to date, skipping build ==="
+fi
 
 # --- inject authorized_keys for SSH access ---
 # Uses the same Ed25519 keys as release signing (from git.mchus.pro/mchus/keys).
diff --git a/scripts/run-builder.sh b/scripts/run-builder.sh
index c9d0ca5..6a0797f 100755
--- a/scripts/run-builder.sh
+++ b/scripts/run-builder.sh
@@ -56,7 +56,8 @@ echo ""
 echo "=== downloading ISO ==="
 LOCAL_ISO_DIR="${REPO_ROOT}/iso/out"
 mkdir -p "${LOCAL_ISO_DIR}"
-scp -o StrictHostKeyChecking=no \
+rsync -az --progress \
+    -e "ssh -o StrictHostKeyChecking=no" \
     "root@${BUILDER_HOST}:/root/bee/dist/*.iso" \
     "${LOCAL_ISO_DIR}/"
 echo ""