diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index ab5e46a..aa9bb0d 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -15,13 +15,14 @@ jobs:
       - uses: cachix/cachix-action@v7
         with:
           name: xe
-      - run: nix-build
+      - run: nix-build --no-out-link
       - name: Log into GitHub Container Registry
         if: github.ref == 'refs/heads/main'
-        run: echo "${{ secrets.CR_PAT }}" | docker login https://ghcr.io -u ${{ github.actor }} --password-stdin
+        run: echo "${{ secrets.CR_PAT }}" | docker login https://ghcr.io -u Xe --password-stdin
       - name: Docker push
         if: github.ref == 'refs/heads/main'
         run: |
+          nix-build ./docker.nix
           docker load -i result
           docker tag xena/christinewebsite:latest ghcr.io/xe/site:$GITHUB_SHA
           docker push ghcr.io/xe/site
diff --git a/default.nix b/default.nix
index 866cfe5..06876b7 100644
--- a/default.nix
+++ b/default.nix
@@ -1,23 +1,51 @@
-{ system ? builtins.currentSystem }:
+{ sources ? import ./nix/sources.nix, pkgs ? import sources.nixpkgs { } }:
+with pkgs;
 
 let
-  sources = import ./nix/sources.nix;
-  pkgs = import sources.nixpkgs { inherit system; };
-  callPackage = pkgs.lib.callPackageWith pkgs;
-  site = callPackage ./site.nix { };
+  srcNoTarget = dir:
+    builtins.filterSource
+    (path: type: type != "directory" || builtins.baseNameOf path != "target")
+    dir;
 
-  dockerImage = pkg:
-    pkgs.dockerTools.buildLayeredImage {
-      name = "xena/christinewebsite";
-      tag = "latest";
+  naersk = pkgs.callPackage sources.naersk { };
+  dhallpkgs = import sources.easy-dhall-nix { inherit pkgs; };
+  src = srcNoTarget ./.;
 
-      contents = [ pkgs.cacert pkg ];
+  xesite = naersk.buildPackage {
+    inherit src;
+    buildInputs = [ pkg-config openssl git ];
+    remapPathPrefix = true;
+  };
 
-      config = {
-        Cmd = [ "${pkg}/bin/xesite" ];
-        Env = [ "CONFIG_FNAME=${pkg}/config.dhall" "RUST_LOG=info" ];
-        WorkingDir = "/";
-      };
-    };
+  config = stdenv.mkDerivation {
+    pname = "xesite-config";
+    version = "HEAD";
+    buildInputs = [ dhallpkgs.dhall-simple ];
 
-in dockerImage site
+    phases = "installPhase";
+
+    installPhase = ''
+      cd ${src}
+      dhall resolve < ${src}/config.dhall >> $out
+    '';
+  };
+
+in pkgs.stdenv.mkDerivation {
+  inherit (xesite) name;
+  inherit src;
+  phases = "installPhase";
+
+  installPhase = ''
+    mkdir -p $out $out/bin
+
+    cp -rf ${config} $out/config.dhall
+    cp -rf $src/blog $out/blog
+    cp -rf $src/css $out/css
+    cp -rf $src/gallery $out/gallery
+    cp -rf $src/signalboost.dhall $out/signalboost.dhall
+    cp -rf $src/static $out/static
+    cp -rf $src/talks $out/talks
+
+    cp -rf ${xesite}/bin/xesite $out/bin/xesite
+  '';
+}
diff --git a/docker.nix b/docker.nix
new file mode 100644
index 0000000..866cfe5
--- /dev/null
+++ b/docker.nix
@@ -0,0 +1,23 @@
+{ system ? builtins.currentSystem }:
+
+let
+  sources = import ./nix/sources.nix;
+  pkgs = import sources.nixpkgs { inherit system; };
+  callPackage = pkgs.lib.callPackageWith pkgs;
+  site = callPackage ./site.nix { };
+
+  dockerImage = pkg:
+    pkgs.dockerTools.buildLayeredImage {
+      name = "xena/christinewebsite";
+      tag = "latest";
+
+      contents = [ pkgs.cacert pkg ];
+
+      config = {
+        Cmd = [ "${pkg}/bin/xesite" ];
+        Env = [ "CONFIG_FNAME=${pkg}/config.dhall" "RUST_LOG=info" ];
+        WorkingDir = "/";
+      };
+    };
+
+in dockerImage site
diff --git a/site.nix b/site.nix
deleted file mode 100644
index 06876b7..0000000
--- a/site.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ sources ? import ./nix/sources.nix, pkgs ? import sources.nixpkgs { } }:
-with pkgs;
-
-let
-  srcNoTarget = dir:
-    builtins.filterSource
-    (path: type: type != "directory" || builtins.baseNameOf path != "target")
-    dir;
-
-  naersk = pkgs.callPackage sources.naersk { };
-  dhallpkgs = import sources.easy-dhall-nix { inherit pkgs; };
-  src = srcNoTarget ./.;
-
-  xesite = naersk.buildPackage {
-    inherit src;
-    buildInputs = [ pkg-config openssl git ];
-    remapPathPrefix = true;
-  };
-
-  config = stdenv.mkDerivation {
-    pname = "xesite-config";
-    version = "HEAD";
-    buildInputs = [ dhallpkgs.dhall-simple ];
-
-    phases = "installPhase";
-
-    installPhase = ''
-      cd ${src}
-      dhall resolve < ${src}/config.dhall >> $out
-    '';
-  };
-
-in pkgs.stdenv.mkDerivation {
-  inherit (xesite) name;
-  inherit src;
-  phases = "installPhase";
-
-  installPhase = ''
-    mkdir -p $out $out/bin
-
-    cp -rf ${config} $out/config.dhall
-    cp -rf $src/blog $out/blog
-    cp -rf $src/css $out/css
-    cp -rf $src/gallery $out/gallery
-    cp -rf $src/signalboost.dhall $out/signalboost.dhall
-    cp -rf $src/static $out/static
-    cp -rf $src/talks $out/talks
-
-    cp -rf ${xesite}/bin/xesite $out/bin/xesite
-  '';
-}