diff --git a/nixosModules/distributedBuilds.nix b/nixosModules/distributedBuilds.nix
index 77946dd..e357e8a 100644
--- a/nixosModules/distributedBuilds.nix
+++ b/nixosModules/distributedBuilds.nix
@@ -68,8 +68,8 @@ in
             remote:
             let
               remoteHost = remote.config.sidonia.services.distributedBuilds.host;
-              remoteFeatures = remote.config.nix.settings.system-features;
               builderName = "${remoteHost.user}_at_${remote.config.networking.hostName}";
+              hostName = builtins.head remoteHost.hostNames;
             in
             lib.mkIf remoteHost.enable {
               programs.ssh = {
@@ -79,24 +79,26 @@ in
                     publicKey = remoteHost.ssh.pubKey;
                   };
                 };
-                extraConfig = ''
-                  Host ${builderName}
-                      User ${remoteHost.user}
-                      Hostname ${builtins.head remoteHost.hostNames}
-                      IdentitiesOnly yes
-                      IdentityFile ${client.ssh.privKeyPath}
-                      ConnectTimeout 3
-                '';
+                # extraConfig = ''
+                #   Host ${builderName}
+                #       User ${remoteHost.user}
+                #       Hostname ${hostName}
+                #       IdentitiesOnly yes
+                #       IdentityFile ${client.ssh.privKeyPath}
+                #       ConnectTimeout 3
+                # '';
               };
               nix = {
                 settings = {
                   trusted-public-keys = [ remoteHost.signing.pubKey ];
-                  substituters = [ "ssh-ng://${builderName}" ];
+                  substituters = [
+                    "${remote.config.nix.sshServe.protocol}://nix-ssh@${hostName}"
+                  ];
                 };
                 buildMachines = [
                   (
                     {
-                      hostName = builtins.head remoteHost.hostNames;
+                      inherit hostName;
                       sshUser = remoteHost.user;
                       sshKey = client.ssh.privKeyPath;
                       #publicHostKey = remoteHost.ssh.pubKey; # don't use this value as it wants base64, fall back to known_hosts instead
@@ -106,7 +108,7 @@ in
                       ];
                       protocol = "ssh-ng";
                       speedFactor = 2;
-                      supportedFeatures = remoteFeatures;
+                      supportedFeatures = remote.config.nix.settings.system-features;
                     }
                     // (if remoteHost.maxJobs != "auto" then { inherit (remoteHost) maxJobs; } else { })
                   )
@@ -131,14 +133,24 @@ in
             in
             lib.mkIf remoteClient.enable {
               users.users.${host.user}.openssh.authorizedKeys.keys = [ remoteClient.ssh.pubKey ];
+              nix.sshServe.keys = [ remoteClient.ssh.pubKey ];
             }
           ))
           ++ [
             {
               users.users.${host.user}.isNormalUser = true;
-              services.openssh.settings.AllowUsers = [ host.user ];
+              services.openssh.settings.AllowUsers = [
+                host.user
+                "nix-ssh"
+              ];
               nix.settings.secret-key-files = host.signing.privKeyPath;
               nix.settings.trusted-users = [ host.user ];
+              nix.sshServe = {
+                enable = true;
+                write = true;
+                trusted = true;
+                protocol = "ssh-ng";
+              };
             }
           ]
         )