diff --git a/hosts/marvin/services/booklore.nix b/hosts/marvin/services/booklore.nix
index 31e56602..7410ce9a 100644
--- a/hosts/marvin/services/booklore.nix
+++ b/hosts/marvin/services/booklore.nix
@@ -2,6 +2,7 @@
   self,
   config,
   pkgs,
+  self',
   ...
 }:
 let
@@ -20,12 +21,14 @@ let
 in
 {
   virtualisation.oci-containers.containers.booklore-server = {
-    image = "ghcr.io/booklore-app/booklore:latest";
+    image = "dishnet-booklore:${self'.packages.booklore-image.imageTag}";
+    imageStream = self'.packages.booklore-image;
     ports = [ "${toString d.port}:${toString d.port}" ];
     volumes = [
       "${dataDir}/data:/app/data"
       "/var/media/books/main:/books"
       "${dataDir}/bookdrop:/bookdrop"
+      "/run/mysqld:/run/mysqld"
     ];
     environment = {
       USER_ID = "${toString u.uid}";
@@ -34,7 +37,6 @@ in
       TZ = "America/New_York";
       DATABASE_USERNAME = "booklore";
       DATABASE_URL = "jdbc:mariadb://localhost:3306/booklore";
-      DATABASE_PASSWORD = "bookloreDatabasePassword123!";
     };
     networks = [ "host" ];
   };
@@ -68,14 +70,6 @@ in
       }
     ];
     ensureDatabases = [ "booklore" ];
-    initialScript = pkgs.writeText "mysql-init.sql" ''
-      CREATE DATABASE IF NOT EXISTS booklore;
-      DROP USER IF EXISTS 'booklore'@'localhost';
-      CREATE USER IF NOT EXISTS 'booklore'@'localhost' IDENTIFIED WITH unix_socket;
-      ALTER USER 'booklore'@'localhost' IDENTIFIED BY 'bookloreDatabasePassword123!';
-      GRANT ALL PRIVILEGES ON booklore.* TO 'booklore'@'localhost';
-      FLUSH PRIVILEGES;
-    '';
   };
   systemd.services.docker-booklore-server.after = [ "mysql.service" ];
 }
diff --git a/packages/booklore-image/package.nix b/packages/booklore-image/package.nix
new file mode 100644
index 00000000..4641797d
--- /dev/null
+++ b/packages/booklore-image/package.nix
@@ -0,0 +1,25 @@
+{ pkgs, ... }:
+let
+  initScript = pkgs.writeShellScriptBin "booklore-init" ''
+    setpriv --reuid 940 --regid 940 --clear-groups -- socat tcp-l:3306,reuseaddr,fork unix:/run/mysqld/mysqld.sock &
+    java -jar /app/app.jar
+  '';
+
+  fetchedImage = pkgs.dockerTools.pullImage {
+    imageName = "ghcr.io/booklore-app/booklore";
+    imageDigest = "sha256:346064cb1fef6149dad2d8a373ea5fd1a7e3b61c22540995e40e8452136e202b";
+    hash = "sha256-TmfMTllg8uB/5F402kuAt3BBgcjx9lPA5LiQ00rKTI0=";
+    finalImageName = "ghcr.io/booklore-app/booklore";
+    finalImageTag = "v2.2.0";
+  };
+in
+pkgs.dockerTools.streamLayeredImage {
+  name = "booklore-dishnet";
+  fromImage = fetchedImage;
+  contents = [
+    pkgs.socat
+    pkgs.util-linux
+    initScript
+  ];
+  config.Cmd = [ "/bin/booklore-init" ];
+}