diff --git a/.github/workflows/mdbook.yml b/.github/workflows/mdbook.yml
index 5bdb655..d1939f5 100644
--- a/.github/workflows/mdbook.yml
+++ b/.github/workflows/mdbook.yml
@@ -8,7 +8,7 @@ permissions:
 
 concurrency:
   group: "pages"
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
   build-book:
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index ad59d77..6b82940 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -7,11 +7,11 @@ permissions:
 
 concurrency:
   group: "nix"
-  cancel-in-progress: false
+  cancel-in-progress: true
 
 jobs:
-  build-nix-flake:
-    name: Build Nix flake (${{ matrix.system }})
+  build-nix-packages:
+    name: Build and push Nix packages (${{ matrix.system }})
     strategy:
       fail-fast: false
       matrix:
@@ -32,18 +32,33 @@ jobs:
           github_access_token: ${{ secrets.GITHUB_TOKEN }}
           extra_nix_config: |
             system = ${{ matrix.system }}
-      - name: Install cachix
+            extra-substituters = ${{ vars.NIKS3_SERVER_URL }}
+            extra-trusted-public-keys = ${{ vars.NIKS3_PUBLIC_KEY }}
+      - id: build
+        name: Build packages
+        run: |
+          echo "sandhole=$(nix build .#sandhole --no-link --print-out-paths)" >> $GITHUB_OUTPUT
+          echo "udp_over_tcp=$(nix build .#udp_over_tcp --no-link --print-out-paths)" >> $GITHUB_OUTPUT
+      - name: Install niks3
         run: |
-          nix-env -iA cachix -f https://cachix.org/api/v1/install
-      - name: Set up cache
+          nix-env -iA niks3 -f '<nixpkgs>'
+      - name: Push to niks3
         env:
-          CACHIX_NAME: ${{ vars.CACHIX_NAME }}
+          NIKS3_AUTH_TOKEN_FILE: "/tmp/niks3-token"
+          NIKS3_SERVER_URL: ${{ vars.NIKS3_SERVER_URL }}
+          SANDHOLE_PATH: ${{ steps.build.outputs.sandhole }}
+          UDP_OVER_TCP_PATH: ${{ steps.build.outputs.udp_over_tcp }}
+        run: |
+          echo ${{ secrets.NIKS3_AUTH_TOKEN }} > /tmp/niks3-token
+          niks3 push ${SANDHOLE_PATH} ${UDP_OVER_TCP_PATH}
+      - name: Install cachix
         run: |
-          cachix use ${CACHIX_NAME}
-      - name: Build and push to Cachix
+          nix-env -iA cachix -f '<nixpkgs>'
+      - name: Push to Cachix
         env:
           CACHIX_NAME: ${{ vars.CACHIX_NAME }}
           CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          SANDHOLE_PATH: ${{ steps.build.outputs.sandhole }}
+          UDP_OVER_TCP_PATH: ${{ steps.build.outputs.udp_over_tcp }}
         run: |
-          nix build .#sandhole --no-link --print-out-paths | cachix push ${CACHIX_NAME}
-          nix build .#udp_over_tcp --no-link --print-out-paths | cachix push ${CACHIX_NAME}
+          cachix push ${CACHIX_NAME} ${SANDHOLE_PATH} ${UDP_OVER_TCP_PATH}
diff --git a/book/src/nixos.md b/book/src/nixos.md
index 757a273..9456073 100644
--- a/book/src/nixos.md
+++ b/book/src/nixos.md
@@ -259,7 +259,7 @@ You can then connect services with the provided keys. For example, to use a Vaul
 
 ## Binary caching
 
-In order to avoid re-building Sandhole for each update, you can use Sandhole's binary cache. In `configuration.nix`:
+In order to avoid re-building Sandhole for each update, you can use either of Sandhole's binary caches. In `configuration.nix`:
 
 ```nix
 {
@@ -267,9 +267,11 @@ In order to avoid re-building Sandhole for each update, you can use Sandhole's b
 
   nix.settings = {
     substituters = [
+      "https://cache.eric.dev.br"
       "https://sandhole.cachix.org"
     ];
     trusted-public-keys = [
+      "cache.eric.dev.br-1:szEyq5LCjxDCUHYSRaSFU5HdHmR7QlT+FRG3tB9QtpE="
       "sandhole.cachix.org-1:cZadr6kgjQcRvsr++Nv9kgtMOrbLahiZBpuI9WpIXvA="
     ];
   };