diff --git a/.webhook_bridge/pipeline-build-hash.yaml b/.webhook_bridge/pipeline-build-hash.yaml
index 4a09b96..89e643f 100644
--- a/.webhook_bridge/pipeline-build-hash.yaml
+++ b/.webhook_bridge/pipeline-build-hash.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
@@ -122,6 +122,8 @@ spec:
               - "type=registry,ref=$(params.image-name):buildcache,mode=max,compression=zstd,compression-level=22,rewrite-timestamp=true,image-manifest=true,oci-mediatypes=true"
               - --opt
               - build-arg:SOURCE_DATE_EPOCH=$(tasks.get-git-commit-time.results.unix-time)
+              - --opt
+              - "build-arg:NIX_SUBSTITUTERS=http://ncps.nix-pull-through-cache.svc.cluster.local:80 https://cache.nixos.org"
           - name: BUILDKITD_TOML
             value: |
               debug = true
diff --git a/.webhook_bridge/pipeline-format.yaml b/.webhook_bridge/pipeline-format.yaml
index 41fded5..98200c6 100644
--- a/.webhook_bridge/pipeline-format.yaml
+++ b/.webhook_bridge/pipeline-format.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-rust-clippy.yaml b/.webhook_bridge/pipeline-rust-clippy.yaml
index e09f431..71e3c4a 100644
--- a/.webhook_bridge/pipeline-rust-clippy.yaml
+++ b/.webhook_bridge/pipeline-rust-clippy.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/.webhook_bridge/pipeline-rust-test.yaml b/.webhook_bridge/pipeline-rust-test.yaml
index 6abce78..15e4924 100644
--- a/.webhook_bridge/pipeline-rust-test.yaml
+++ b/.webhook_bridge/pipeline-rust-test.yaml
@@ -62,7 +62,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: "31376f29c6332ea8c378152d5ccda1ba9dbcd7bb"
+              value: "dda7b690195b43e8b9859d1caf5dcbf48588ade1"
             - name: pathInRepo
               value: task/git-clone/0.1/git-clone.yaml
           resolver: git
@@ -101,7 +101,7 @@ spec:
             - name: url
               value: https://code.fizz.buzz/talexander/personal_tekton_catalog.git
             - name: revision
-              value: 31376f29c6332ea8c378152d5ccda1ba9dbcd7bb
+              value: dda7b690195b43e8b9859d1caf5dcbf48588ade1
             - name: pathInRepo
               value: task/buildkit-rootless-daemonless/0.1/buildkit-rootless-daemonless.yaml
         params:
diff --git a/docker/natter/Dockerfile b/docker/natter/Dockerfile
index 9c266d2..62af093 100644
--- a/docker/natter/Dockerfile
+++ b/docker/natter/Dockerfile
@@ -1,18 +1,24 @@
+# syntax=docker/dockerfile:1
 #
 # Builder
 #
+ARG NIX_SUBSTITUTERS=https://cache.nixos.org
 
 FROM nixos/nix:2.31.3 AS builder
 
-RUN cp "$(nix --extra-experimental-features "nix-command flakes" --option filter-syscalls false build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
+ARG NIX_SUBSTITUTERS
+RUN tee -a /etc/nix/nix.conf <<EOF
+extra-experimental-features = nix-command flakes
+filter-syscalls = false
+substituters = $NIX_SUBSTITUTERS
+EOF
+
+RUN cp "$(nix build nixpkgs#cacert --print-out-paths)/etc/ssl/certs/ca-bundle.crt" /tmp/ca-bundle.crt
 
 COPY . /tmp/build
 WORKDIR /tmp/build
 
-RUN nix \
-    --extra-experimental-features "nix-command flakes" \
-    --option filter-syscalls false \
-    build '.#docker_env'
+RUN --mount=type=ssh GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" nix build '.#docker_env'
 
 # Export the built closure to a folder
 RUN mkdir /tmp/nix-store-closure
@@ -36,5 +42,5 @@ COPY --from=builder /tmp/ca-bundle.crt /etc/ssl/certs/ca-bundle.crt
 
 COPY --from=builder /tmp/nix-store-closure /nix/store
 COPY --from=builder /tmp/build/result /app
-EXPOSE 8080
+
 CMD ["/app/bin/natter"]