diff --git a/flake.lock b/flake.lock
index dec7062..3f24095 100644
--- a/flake.lock
+++ b/flake.lock
@@ -345,14 +345,14 @@
     "ibm-plex-mono-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1731402384,
+        "lastModified": 1731402378,
         "narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
       },
       "original": {
         "type": "tarball",
-        "url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
+        "url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
       }
     },
     "ibm-plex-mono-src_2": {
@@ -479,7 +479,7 @@
     "microvm": {
       "inputs": {
         "nixpkgs": [
-          "tangled-mirror",
+          "tangled",
           "nixpkgs"
         ],
         "spectrum": "spectrum"
@@ -498,6 +498,28 @@
         "type": "github"
       }
     },
+    "microvm_2": {
+      "inputs": {
+        "nixpkgs": [
+          "tangled",
+          "nixpkgs"
+        ],
+        "spectrum": "spectrum_2"
+      },
+      "locked": {
+        "lastModified": 1779970379,
+        "narHash": "sha256-ZHsxoYXXnfJtMVh1/yY+1Eh9hHcPBhE28Qvinauh+BQ=",
+        "owner": "microvm-nix",
+        "repo": "microvm.nix",
+        "rev": "0d49083ba2d7419b22908ac392777c16df9a032e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "microvm-nix",
+        "repo": "microvm.nix",
+        "type": "github"
+      }
+    },
     "nixery-flake": {
       "flake": false,
       "locked": {
@@ -655,6 +677,22 @@
         "url": "https://spectrum-os.org/git/spectrum"
       }
     },
+    "spectrum_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1778940603,
+        "narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
+        "ref": "refs/heads/main",
+        "rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
+        "revCount": 1265,
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://spectrum-os.org/git/spectrum"
+      }
+    },
     "sqlite-lib-src": {
       "flake": false,
       "locked": {
@@ -755,15 +793,16 @@
         "inter-fonts-src": "inter-fonts-src",
         "lucide-src": "lucide-src",
         "mermaid-src": "mermaid-src",
+        "microvm": "microvm",
         "nixpkgs": "nixpkgs_4",
         "sqlite-lib-src": "sqlite-lib-src"
       },
       "locked": {
-        "lastModified": 1781711822,
-        "narHash": "sha256-dZbFW2gzjCN4tCinxRqY6+exaCZN5Hi1j8E6vmntqsU=",
+        "lastModified": 1781899836,
+        "narHash": "sha256-b6VyrY1b5gst7J51IULIFFBgTzMH+kxid549vVS1sWs=",
         "ref": "master",
-        "rev": "761e710f29fba3ea2408c889261a55bfcbd06777",
-        "revCount": 2703,
+        "rev": "4dcbbc934dfa0097ca0039756231bbb4713811e0",
+        "revCount": 2724,
         "type": "git",
         "url": "https://knot1.tangled.sh/tangled.org/core"
       },
@@ -786,7 +825,7 @@
         "inter-fonts-src": "inter-fonts-src_2",
         "lucide-src": "lucide-src_2",
         "mermaid-src": "mermaid-src_2",
-        "microvm": "microvm",
+        "microvm": "microvm_2",
         "nixpkgs": "nixpkgs_5",
         "sqlite-lib-src": "sqlite-lib-src_2"
       },
diff --git a/flake.nix b/flake.nix
index 99a6368..8435cfd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -42,7 +42,13 @@
     mkHost = hostname: extraModules:
       lib.nixosSystem {
         inherit system;
-        specialArgs = {inherit commonArgs;};
+        specialArgs = {
+          inherit commonArgs;
+          nixery-pkgs = import nixery-flake.outPath {
+            pkgs = import nixpkgs {inherit system;};
+          };
+          tangled-pkgs = tangled.packages.x86_64-linux;
+        };
         modules = baseModules ++ [./hosts/${hostname}/configuration.nix] ++ extraModules;
       };
 
diff --git a/hosts/spindle-hel/services/cache.nix b/hosts/spindle-hel/services/cache.nix
index ae2baad..f74e022 100644
--- a/hosts/spindle-hel/services/cache.nix
+++ b/hosts/spindle-hel/services/cache.nix
@@ -20,7 +20,6 @@ in
       workers = 4;
       max_connection_rate = 256;
       priority = 50;
-      enable_compression = true;
     };
   };
 
diff --git a/hosts/spindle-hel/services/spindle.nix b/hosts/spindle-hel/services/spindle.nix
index 46019f6..93cf002 100644
--- a/hosts/spindle-hel/services/spindle.nix
+++ b/hosts/spindle-hel/services/spindle.nix
@@ -1,8 +1,11 @@
 {
   config,
-  pkgs,
+  tangled-pkgs,
   ...
-}: {
+}:
+{
+  boot.kernelModules = ["vhost_vsock"];
+
   services.tangled.spindle = {
     enable = true;
     server = {
@@ -11,13 +14,38 @@
       listenAddr = "127.0.0.1:6555";
       queueSize = 100;
       maxJobCount = 8;
-      maxConcurrentWorkflows = 16;
       secrets = {
         provider = "openbao";
       };
     };
     pipelines = {
       workflowTimeout = "15m";
+      nixery.maxConcurrentWorkflows = 16;
+      microvm = {
+        limits.total.memoryMiB = 40 * 1024; # 30gb + 10gb overcommit
+        cgroup = {
+          enable = true;
+          swapMaxMiB = 512; # don't let workflows use too much swap, will be too slow
+        };
+      };
+      nixCache = {
+        readUrls = [
+          "https://cache.nixos.org"
+          "http://${config.services.harmonia.settings.bind}"
+        ];
+        trustedPublicKeys = [
+          "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "spindle-hel-cache-1:r4faXZnMLFyTJeIQn+sQuO/Pgu2ZMTMncmXb2CPZtUw="
+        ];
+        # uploadUrl = "ssh-ng://localhost";
+      };
     };
   };
+
+  systemd.tmpfiles.rules = [
+    "L+ /var/lib/spindle/images/nixos-x86_64 - - - - ${tangled-pkgs.spindle-nixos-image}"
+    "L+ /var/lib/spindle/images/nixos - - - - /var/lib/spindle/images/nixos-x86_64"
+    "L+ /var/lib/spindle/images/alpine-x86_64 - - - - ${tangled-pkgs.spindle-alpine-image}"
+    "L+ /var/lib/spindle/images/alpine - - - - /var/lib/spindle/images/alpine-x86_64"
+  ];
 }