diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 00000000..e0042be6
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,22 @@
+## Status
+
+Ready for review / Work in progress
+
+## Description of Changes
+
+Fixes #.
+
+Changes proposed in this pull request:
+
+## Testing
+
+How should the reviewer test this PR?
+Write out any special testing steps here.
+
+## Checklist
+
+### If you have made changes to the provisioning logic
+
+- [ ] Linting (`make flake8`) and tests (`make test`) pass in dom0 of a Qubes install
+
+- [ ] I have added/removed files, and have updated packaging logic in MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec
diff --git a/MANIFEST.in b/MANIFEST.in
index 9fd79a0c..4bb3b085 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -1,12 +1,20 @@
 include dom0/*.sls
 include dom0/*.top
+include dom0/*.j2
 include dom0/securedrop-update
+include dom0/securedrop-login
+include dom0/securedrop-launcher.desktop
+include dom0/securedrop-handle-upgrade
 include config.json.example
 include README.md
 include LICENSE
 include VERSION
 include Makefile
 include sd-proxy/*
+include sd-whonix/*
 include sd-app/*
 include sd-workstation/*
 include scripts/*
+include sys-firewall/*
+include launcher/*.py
+include launcher/sdw_updater_gui/*.py
diff --git a/rpm-build/SPECS/securedrop-workstation-dom0-config.spec b/rpm-build/SPECS/securedrop-workstation-dom0-config.spec
index 257d0cf6..bef07248 100644
--- a/rpm-build/SPECS/securedrop-workstation-dom0-config.spec
+++ b/rpm-build/SPECS/securedrop-workstation-dom0-config.spec
@@ -30,33 +30,46 @@ configuration over time.
 %{__python3} setup.py build
 
 %install
-%{__python3} setup.py install --skip-build --root %{buildroot}
+%{__python3} setup.py install --no-compile --skip-build --root %{buildroot}
+install -m 755 -d %{buildroot}/opt/securedrop/launcher
+install -m 755 -d %{buildroot}/opt/securedrop/launcher/sdw_updater_gui
 install -m 755 -d %{buildroot}/srv
 install -m 755 -d %{buildroot}/srv/salt/sd
 install -m 755 -d %{buildroot}/srv/salt/sd/sd-app
+install -m 755 -d %{buildroot}/srv/salt/sd/sd-proxy
 install -m 755 -d %{buildroot}/srv/salt/sd/sd-journalist
+install -m 755 -d %{buildroot}/srv/salt/sd/sd-whonix
 install -m 755 -d %{buildroot}/srv/salt/sd/sd-workstation
-install -m 755 -d %{buildroot}/usr/share/securedrop-workstation-dom0-config/scripts
-install -m 755 -d %{buildroot}/usr/share/securedrop/icons
+install -m 755 -d %{buildroot}/srv/salt/sd/sys-firewall
+install -m 755 -d %{buildroot}/usr/share/%{name}/scripts
 install -m 644 dom0/*.sls %{buildroot}/srv/salt/
 install -m 644 dom0/*.top %{buildroot}/srv/salt/
+install -m 644 dom0/*.j2 %{buildroot}/srv/salt/
+install -m 644 dom0/securedrop-update %{buildroot}/srv/salt/
+install -m 644 dom0/securedrop-login %{buildroot}/srv/salt/
+install -m 644 dom0/securedrop-launcher.desktop %{buildroot}/srv/salt/
+install -m 655 dom0/securedrop-handle-upgrade %{buildroot}/srv/salt/
 # The next file should get installed via RPM not via salt
 install -m 755 dom0/securedrop-update %{buildroot}/srv/salt/securedrop-update
-install sd-app/* %{buildroot}/srv/salt/sd/sd-app/
-install sd-workstation/* %{buildroot}/srv/salt/sd/sd-workstation/
-install -m 644 sd-proxy/logo-small.png %{buildroot}/usr/share/securedrop/icons/sd-logo.png
+install -m 644 sd-app/* %{buildroot}/srv/salt/sd/sd-app/
+install -m 644 sd-proxy/* %{buildroot}/srv/salt/sd/sd-proxy/
+install -m 644 sd-whonix/* %{buildroot}/srv/salt/sd/sd-whonix/
+install -m 644 sd-workstation/* %{buildroot}/srv/salt/sd/sd-workstation/
+install -m 644 sys-firewall/* %{buildroot}/srv/salt/sd/sys-firewall/
 install -m 644 Makefile %{buildroot}/usr/share/%{name}/Makefile
 install -m 755 scripts/* %{buildroot}/usr/share/%{name}/scripts/
+install -m 644 launcher/*.py %{buildroot}/opt/securedrop/launcher/
+install -m 644 launcher/sdw_updater_gui/*.py %{buildroot}/opt/securedrop/launcher/sdw_updater_gui/
 %files
 %doc README.md LICENSE
 %{python3_sitelib}/securedrop_workstation_dom0_config*
 %{_datadir}/%{name}
-%{_datadir}/securedrop/*
 %{_bindir}/securedrop-update
 /srv/salt/sd*
+/srv/salt/dom0-xfce-desktop-file.j2
+/srv/salt/securedrop-*
 /srv/salt/fpf*
-/srv/salt/securedrop-update
-
+/opt/securedrop/*
 %post
 find /srv/salt -maxdepth 1 -type f -iname '*.top' \
     | xargs -n1 basename \
@@ -69,4 +82,3 @@ find /srv/salt -maxdepth 1 -type f -iname '*.top' \
 
 * Fri Oct 26 2018 Kushal Das <kushal@freedom.press> - 0.0.1-1
 - First release
-