diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 5e0a750..eccedcf 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -10,3 +10,10 @@ jobs:
     - uses: cachix/cachix-action@v3
       with:
         name: xe
+    - run: |
+        nix-build docker.nix
+        docker load -i result
+        docker tag xena/christinewebsite:latest xena/christinewebsite:$(echo $GITHUB_SHA | head -c7)
+    - run: |
+        nix-env -if ./nix/dhall-yaml.nix
+        dhall-to-yaml-ng --omit-empty --file site.dhall
diff --git a/default.nix b/default.nix
index 1fe3a98..901845d 100644
--- a/default.nix
+++ b/default.nix
@@ -1,3 +1,6 @@
-{ pkgs ? import <nixpkgs> {} }:
+{ }:
 
-pkgs.callPackage ./site.nix {}
+let
+  sources = import ./nix/sources.nix;
+  pkgs = import sources.nixpkgs { };
+in pkgs.callPackage ./site.nix { inherit pkgs; }
diff --git a/docker.nix b/docker.nix
index 4b2cbc6..df925a0 100644
--- a/docker.nix
+++ b/docker.nix
@@ -1,14 +1,12 @@
 { system ? builtins.currentSystem }:
 
 let
-  pkgs = import <nixpkgs> { inherit system; };
-
+  pkgs = import (import ./nix/sources.nix).nixpkgs { inherit system; };
   callPackage = pkgs.lib.callPackageWith pkgs;
-
   site = callPackage ./site.nix { };
 
   dockerImage = pkg:
-    pkgs.dockerTools.buildImage {
+    pkgs.dockerTools.buildLayeredImage {
       name = "xena/christinewebsite";
       tag = pkg.version;
 
diff --git a/nix/dhall-yaml.nix b/nix/dhall-yaml.nix
new file mode 100644
index 0000000..ddb8c3d
--- /dev/null
+++ b/nix/dhall-yaml.nix
@@ -0,0 +1,5 @@
+let
+  sources = import ./sources.nix;
+  pkgs = import sources.nixpkgs { };
+  dhall = import sources.easy-dhall-nix { inherit pkgs; };
+in dhall.dhall-yaml-simple
diff --git a/nix/sources.json b/nix/sources.json
index 225728a..937f537 100644
--- a/nix/sources.json
+++ b/nix/sources.json
@@ -1,4 +1,40 @@
 {
+    "easy-dhall-nix": {
+        "branch": "master",
+        "description": "Derivations for easily downloading Dhall binaries and putting them to use.",
+        "homepage": "",
+        "owner": "justinwoo",
+        "repo": "easy-dhall-nix",
+        "rev": "735ad924fd829c9bbee0a167e0b2bbbf91e2cad5",
+        "sha256": "1r3sqs1cz0mcfwfvaq1d21vnppg5sqzqdl6w9krsw5ad5czkk190",
+        "type": "tarball",
+        "url": "https://github.com/justinwoo/easy-dhall-nix/archive/735ad924fd829c9bbee0a167e0b2bbbf91e2cad5.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "niv": {
+        "branch": "master",
+        "description": "Easy dependency management for Nix projects",
+        "homepage": "https://github.com/nmattia/niv",
+        "owner": "nmattia",
+        "repo": "niv",
+        "rev": "2ecfd86b631714b457e56d70dd83fa60435baeb6",
+        "sha256": "01j6727cws8blg1npp54b4w6xa0gpgyzhyws2vqgp8clnlnmqqhi",
+        "type": "tarball",
+        "url": "https://github.com/nmattia/niv/archive/2ecfd86b631714b457e56d70dd83fa60435baeb6.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
+    "nixpkgs": {
+        "branch": "nixpkgs-unstable",
+        "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to",
+        "homepage": "https://github.com/NixOS/nixpkgs",
+        "owner": "NixOS",
+        "repo": "nixpkgs-channels",
+        "rev": "cc1ae9f21b9e0ce998e706a3de1bad0b5259f22d",
+        "sha256": "0zjafww05h50ncapw51b5qxgbv9prjyag0j22jnfc3kcs5xr4ap0",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs-channels/archive/cc1ae9f21b9e0ce998e706a3de1bad0b5259f22d.tar.gz",
+        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
+    },
     "vgo2nix": {
         "branch": "master",
         "description": null,
@@ -14,7 +50,7 @@
     "xepkgs": {
         "ref": "master",
         "repo": "https://tulpa.dev/Xe/nixpkgs",
-        "rev": "71488e7dd46c9530d6781ab7845e6f720591a0b0",
+        "rev": "e0027d79c85aab9411c69acaadaabd2189400cc9",
         "type": "git"
     }
 }
diff --git a/shell.nix b/shell.nix
index fd893ee..6abe8a7 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,6 +1,11 @@
 let
-  pkgs = import <nixpkgs> { };
   sources = import ./nix/sources.nix;
-  xepkgs = import sources.xepkgs { };
-  vgo2nix = import sources.vgo2nix { };
-in pkgs.mkShell { buildInputs = [ pkgs.go pkgs.niv xepkgs.gopls vgo2nix ]; }
+  pkgs = import sources.nixpkgs { };
+  niv = (import sources.niv { }).niv;
+  dhall-yaml =
+    (import sources.easy-dhall-nix { inherit pkgs; }).dhall-yaml-simple;
+  xepkgs = import sources.xepkgs { inherit pkgs; };
+  vgo2nix = import sources.vgo2nix { inherit pkgs; };
+in pkgs.mkShell {
+  buildInputs = [ pkgs.go xepkgs.gopls dhall-yaml niv vgo2nix ];
+}
diff --git a/site.dhall b/site.dhall
new file mode 100644
index 0000000..f126d3d
--- /dev/null
+++ b/site.dhall
@@ -0,0 +1,23 @@
+let kms =
+      https://xena.greedo.xeserv.us/pkg/dhall/kubermemes/k8s/package.dhall sha256:e47e95aba6a08f8ca3e38fbabc436566d6558a05a9b4ac149e8e712c8583b8f0
+
+let kubernetes =
+      https://xena.greedo.xeserv.us/pkg/dhall/dhall-kubernetes/1.15/package.dhall sha256:271494d6e3daba2a47d9d023188e35bf44c9c477a1cfbad1c589695a6b626e56
+
+let tag = env:GITHUB_SHA as Text ? "latest"
+
+let image = "xena/christinewebsite:${tag}"
+
+let vars
+    : List kubernetes.EnvVar.Type
+    = [ kubernetes.EnvVar::{ name = "PORT", value = Some "5000" } ]
+
+in  kms.app.make
+      kms.app.Config::{
+      , name = "christinewebsite"
+      , appPort = 5000
+      , image = image
+      , domain = "christine.website"
+      , leIssuer = "prod"
+      , envVars = vars
+      }
diff --git a/site.nix b/site.nix
index 7062d9b..59996a8 100644
--- a/site.nix
+++ b/site.nix
@@ -1,4 +1,4 @@
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs ? import (import ./nix/sources.nix).nixpkgs }:
 with pkgs;
 
 assert lib.versionAtLeast go.version "1.13";
@@ -8,10 +8,9 @@ buildGoPackage rec {
   version = "latest";
   goPackagePath = "christine.website";
   src = ./.;
-  nativeBuildInputs = [ makeWrapper ];
-
   goDeps = ./deps.nix;
   allowGoReference = false;
+
   preBuild = ''
     export CGO_ENABLED=0
     buildFlagsArray+=(-pkgdir "$TMPDIR")