diff --git a/spindle/engine/engine.go b/spindle/engine/engine.go
index 54570805..91cec2ef 100644
--- a/spindle/engine/engine.go
+++ b/spindle/engine/engine.go
@@ -497,10 +497,16 @@ func hostConfig(wid models.WorkflowId) *container.HostConfig {
 					Mode: 0o1777, // world-writeable sticky bit
 				},
 			},
+			{
+				Type:   mount.TypeVolume,
+				Source: "etc-nix-" + wid.String(),
+				Target: "/etc/nix",
+			},
 		},
 		ReadonlyRootfs: false,
 		CapDrop:        []string{"ALL"},
-		SecurityOpt:    []string{"seccomp=unconfined"},
+		CapAdd:         []string{"CAP_DAC_OVERRIDE"},
+		SecurityOpt:    []string{"no-new-privileges"},
 	}
 
 	return hostConfig
diff --git a/spindle/models/pipeline.go b/spindle/models/pipeline.go
index 5fbfea0b..f15f92cb 100644
--- a/spindle/models/pipeline.go
+++ b/spindle/models/pipeline.go
@@ -55,6 +55,7 @@ func ToPipeline(pl tangled.Pipeline, cfg config.Config) *Pipeline {
 		swf.addNixProfileToPath()
 		setup := &setupSteps{}
 
+		setup.addStep(nixConfStep())
 		setup.addStep(cloneStep(*twf, *pl.TriggerMetadata.Repo, cfg.Server.Dev))
 		setup.addStep(checkoutStep(*twf, *pl.TriggerMetadata))
 		setup.addStep(dependencyStep(*twf))
diff --git a/spindle/models/setup_steps.go b/spindle/models/setup_steps.go
index 56aad0d4..9b99a5a2 100644
--- a/spindle/models/setup_steps.go
+++ b/spindle/models/setup_steps.go
@@ -8,6 +8,15 @@ import (
 	"tangled.sh/tangled.sh/core/api/tangled"
 )
 
+func nixConfStep() Step {
+	setupCmd := `echo 'extra-experimental-features = nix-command flakes' >> /etc/nix/nix.conf
+echo 'build-users-group = ' >> /etc/nix/nix.conf`
+	return Step{
+		Command: setupCmd,
+		Name:    "Configure Nix",
+	}
+}
+
 // checkoutStep checks out the specified ref in the cloned repository.
 func checkoutStep(twf tangled.Pipeline_Workflow, tr tangled.Pipeline_TriggerMetadata) Step {
 	if twf.Clone.Skip {