diff --git a/.github/workflows/website.yaml b/.github/workflows/website.yaml
index f4e27767b..834fe9291 100644
--- a/.github/workflows/website.yaml
+++ b/.github/workflows/website.yaml
@@ -107,19 +107,10 @@ jobs:
         uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha || inputs.branch || 'production' }}
-          submodules: false
+          # the only submodule is closed, which needs secrets
+          submodules: ${{ env.HAS_ROOT_REPO_CONTEXT == 'true' && 'recursive' || 'false' }}
           token: ${{ secrets.GH_TOKEN || github.token }}
 
-      # Future proofing for Reforged: we'll have both closed and open repos, so
-      # we need to handle them here instead of disabling submodules outright
-      - name: Checkout submodules
-        run: |
-          if [ "$HAS_ROOT_REPO_CONTEXT" = "true" ]; then
-            git submodule update --init --recursive --depth=1
-          else
-            git submodule update --init --recursive --depth=1 -- . ':!packages/closed'
-          fi
-
       - name: Setup bun
         uses: oven-sh/setup-bun@v2
 
diff --git a/packages/core/src/blitzkit/api/server/0_base.ts b/packages/core/src/blitzkit/api/server/0_base.ts
index b8dc459ed..912ee23b8 100644
--- a/packages/core/src/blitzkit/api/server/0_base.ts
+++ b/packages/core/src/blitzkit/api/server/0_base.ts
@@ -104,6 +104,7 @@ export abstract class ServerBlitzKitAPI0 extends AbstractBlitzKitAPI {
   protected gameTypeSelectorStyles?: SquadBattleTypeStylesYaml;
   protected combatRoles?: CombatRolesYaml;
   protected tierEqualizer?: string[][];
+  protected version?: string;
 
   constructor(vfs: AbstractVFS) {
     super();
@@ -115,15 +116,11 @@ export abstract class ServerBlitzKitAPI0 extends AbstractBlitzKitAPI {
     const { existsSync } = await import("fs");
     const { readFile, writeFile, mkdir } = await import("fs/promises");
 
-    console.log("Initializing virtual file system...");
-
     const path = await import("node:path");
 
     this.extname = path.extname;
     this.parsePath = path.parse;
 
-    await this.vfs.init();
-
     console.log("Fetching game data...");
     this.nationsDir = await this.vfs
       .dir("Data/XML/item_defs/vehicles")
@@ -161,11 +158,13 @@ export abstract class ServerBlitzKitAPI0 extends AbstractBlitzKitAPI {
       { delimiter: ";" },
     );
 
+    this.version = (await this.vfs.text("Data/version.txt")).split(" ")[0];
+
     console.log("Fetching game localizations...");
 
     await Promise.all(
       locales.supported.map(async ({ locale }) => {
-        const root = "../../temp/game-strings";
+        const root = `../../temp/game-strings/${this.version}`;
         const cachePath = `${root}/${locale}.json`;
 
         if (existsSync(cachePath)) {
diff --git a/packages/core/src/blitzkit/api/server/9_game.ts b/packages/core/src/blitzkit/api/server/9_game.ts
index 9c70f6402..2e6853270 100644
--- a/packages/core/src/blitzkit/api/server/9_game.ts
+++ b/packages/core/src/blitzkit/api/server/9_game.ts
@@ -20,9 +20,7 @@ export abstract class ServerBlitzKitAPI9 extends ServerBlitzKitAPI8 {
       provisionNativeNames[key] = provision.id;
     });
 
-    const version = (await this.vfs.text("Data/version.txt")).split(" ")[0];
-
-    gameDefinitions.version = version;
+    gameDefinitions.version = this.version!;
     gameDefinitions.nations = (
       await this.vfs.yaml<AvailableNationsYaml>("Data/available_nations.yaml")
     ).available_nations;
diff --git a/packages/core/src/blitzkit/vfs/client.ts b/packages/core/src/blitzkit/vfs/client.ts
new file mode 100644
index 000000000..9a314801b
--- /dev/null
+++ b/packages/core/src/blitzkit/vfs/client.ts
@@ -0,0 +1,18 @@
+import { assertSecret } from "@blitzkit/core";
+import { AbstractVFS } from "./abstract";
+import { LocalVFS } from "./local";
+import { ZipVFS } from "./zip";
+
+export async function createClientVFS() {
+  let vfs: AbstractVFS;
+
+  if (import.meta.env.CLIENT_PROVIDER === "zip") {
+    vfs = new ZipVFS(assertSecret(import.meta.env.CLIENT_SOURCE));
+  } else {
+    vfs = new LocalVFS(assertSecret(import.meta.env.CLIENT_DIR));
+  }
+
+  await vfs.init();
+
+  return vfs;
+}
diff --git a/packages/scripts/src/downloadClient/index.ts b/packages/scripts/src/downloadClient/index.ts
index 44b5531bd..464d54b58 100644
--- a/packages/scripts/src/downloadClient/index.ts
+++ b/packages/scripts/src/downloadClient/index.ts
@@ -3,7 +3,6 @@ import { mkdir, rm } from "node:fs/promises";
 import { downloadSteamClient } from "./steam";
 import { downloadWGCClient } from "./wgc";
 import { downloadWGPKGClient } from "./wgpkg";
-import { downloadZipClient } from "./zip";
 
 export const DEPOT_DOWNLOADER_RETRY_TIME = 30_000;
 
@@ -20,9 +19,9 @@ switch (provider) {
     await downloadSteamClient();
     break;
 
-  // from zip, usually has a root directory for opentest
+  // from zip, read remotely by ZipVFS at build time; nothing to download
   case "zip":
-    await downloadZipClient();
+    console.log("Zip client provider; skipping download in favor of ZipVFS");
     break;
 
   // effectively the same as wgc, but direct for preview
diff --git a/packages/scripts/src/vfs/vfs.ts b/packages/scripts/src/vfs/vfs.ts
index 2461b5dc5..48d6baa82 100644
--- a/packages/scripts/src/vfs/vfs.ts
+++ b/packages/scripts/src/vfs/vfs.ts
@@ -1,6 +1,3 @@
-import { assertSecret } from "@blitzkit/core";
-import { LocalVFS } from "@blitzkit/core/src/blitzkit/vfs/local";
+import { createClientVFS } from "@blitzkit/core/src/blitzkit/vfs/client";
 
-export const vfs = await new LocalVFS(
-  assertSecret(import.meta.env.CLIENT_DIR),
-).init();
+export const vfs = await createClientVFS();
diff --git a/packages/website/src/core/blitzkit/vfs.ts b/packages/website/src/core/blitzkit/vfs.ts
index a94b39bae..48d6baa82 100644
--- a/packages/website/src/core/blitzkit/vfs.ts
+++ b/packages/website/src/core/blitzkit/vfs.ts
@@ -1,4 +1,3 @@
-import { assertSecret } from "@blitzkit/core";
-import { LocalVFS } from "@blitzkit/core/src/blitzkit/vfs/local";
+import { createClientVFS } from "@blitzkit/core/src/blitzkit/vfs/client";
 
-export const vfs = new LocalVFS(assertSecret(import.meta.env.CLIENT_DIR));
+export const vfs = await createClientVFS();