diff --git a/.github/workflows/qemu-image-build.yml b/.github/workflows/qemu-image-build.yml
index dfacd0aeb2..cb01de3b4e 100644
--- a/.github/workflows/qemu-image-build.yml
+++ b/.github/workflows/qemu-image-build.yml
@@ -66,6 +66,10 @@ jobs:
 
       - name: Install Nix
         uses: $/.github/actions/install-nix
+        with:
+          push-to-cache: true
+          nix-signing-key: ${{ secrets.NIX_SIGN_SECRET_KEY }}
+          role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
 
       - name: Run checks if triggered manually
         if: ${{ github.event_name == 'workflow_dispatch' && matrix.arch == 'arm64' }}
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index f8ba523d1f..f35c1d7945 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -187,7 +187,7 @@
       when: stage2
       shell: >-
         baseline={{ 'ami' if not qemu else 'qemu' }}-build-{{ platform }}
-        nix shell github:supabase/postgres/{{ git_commit_sha }}#supascan --command
+        nix shell {{ nix_store_paths['supascan'] }} --command
         /tmp/ansible-playbook/ansible/files/supascan_ami.sh
         /tmp/ansible-playbook/audit-specs/baselines/$baseline
 
diff --git a/ansible/tasks/setup-pgbackrest.yml b/ansible/tasks/setup-pgbackrest.yml
index 1aac4189f0..cc54a844db 100644
--- a/ansible/tasks/setup-pgbackrest.yml
+++ b/ansible/tasks/setup-pgbackrest.yml
@@ -122,7 +122,7 @@
 - name: Install pgBackRest
   when: stage2
   ansible.builtin.shell: |
-    sudo -u pgbackrest bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pg-backrest"
+    . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['pg-backrest'] }}
   become: true
   become_user: pgbackrest
   changed_when: true
diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml
index d76aa46b8e..a6ee5b90f1 100644
--- a/ansible/tasks/setup-pgbouncer.yml
+++ b/ansible/tasks/setup-pgbouncer.yml
@@ -18,8 +18,9 @@
 - name: Install PgBouncer from nix binary cache
   when: stage2
   ansible.builtin.shell:
-    cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pgbouncer"
+    cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['pgbouncer'] }}
   become: true
+  become_user: pgbouncer
 
 - name: Link PgBouncer into /usr/local/bin
   when: stage2
diff --git a/ansible/tasks/setup-wal-g.yml b/ansible/tasks/setup-wal-g.yml
index d2b7aba41c..eb4e6931b7 100644
--- a/ansible/tasks/setup-wal-g.yml
+++ b/ansible/tasks/setup-wal-g.yml
@@ -36,14 +36,15 @@
   block:
     - name: Install wal-g 2 from nix binary cache
       ansible.builtin.shell:
-        cmd: sudo -u wal-g bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#wal-g-2"
+        cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['wal-g-2'] }}
       become: true
+      become_user: wal-g
 
     # Installed alongside v2 (INDATA-904). The /usr/local/bin/wal-g symlink below
     # only points at v3 on orioledb builds; v2 remains the default everywhere else.
     - name: Install wal-g 3 from nix binary cache
       ansible.builtin.shell:
-        cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#wal-g-3
+        cmd: . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install {{ nix_store_paths['wal-g-3'] }}
       become: true
       become_user: wal-g
 
diff --git a/ansible/tasks/stage2-setup-postgres.yml b/ansible/tasks/stage2-setup-postgres.yml
index 5f8028b0b7..9dd0611f72 100644
--- a/ansible/tasks/stage2-setup-postgres.yml
+++ b/ansible/tasks/stage2-setup-postgres.yml
@@ -56,25 +56,17 @@
   when: stage2
   become: true
   block:
-    - name: Resolve postgres env store path
-      ansible.builtin.shell: |
-        sudo -u postgres bash -c "
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
-          nix build --no-link --print-out-paths github:supabase/postgres/{{ git_commit_sha }}#postgres-env-{{ postgres_major_version }}
-        "
-      register: postgres_env_path
-
     - name: Install postgres env from nix binary cache
       ansible.builtin.shell: |
-        sudo -u postgres bash -c "
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
-          nix-env --set {{ postgres_env_path.stdout }}
-        "
+        . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
+        nix-env --quiet --set {{ nix_store_paths['postgres-env'] }}
+      become: true
+      become_user: postgres
 
     - name: Install and activate site env from nix binary cache
       ansible.builtin.shell: |
         . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh &&
-        nix-env --profile /nix/var/nix/profiles/site --set {{ site_env_path }} &&
+        nix-env --profile /nix/var/nix/profiles/site --set {{ nix_store_paths['site-env'] }} &&
         /nix/var/nix/profiles/site/bin/activate
 
     - name: Set ownership and permissions for file and dirs
@@ -126,11 +118,13 @@
             - name: Create symbolic link for linux-pam to find pam_jit_pg.so
               become: yes
               shell: |
-                sudo ln -s /var/lib/postgresql/.nix-profile/lib/security/pam_jit_pg.so $(find /nix/store -type d -path "/nix/store/*-linux-pam-*/lib/security" -print -quit)/pam_jit_pg.so
+                ln -s /var/lib/postgresql/.nix-profile/lib/security/pam_jit_pg.so $(find /nix/store -type d -path "/nix/store/*-linux-pam-*/lib/security" -print -quit)/pam_jit_pg.so
 
             - name: Get gatekeeper version
               ansible.builtin.shell: |
-                sudo -u postgres bash -c "/nix/var/nix/profiles/default/bin/nix-store -q --requisites ~/.nix-profile | awk -F- '/gatekeeper/{print \$NF}'"
+                /nix/var/nix/profiles/default/bin/nix-store -q --requisites /var/lib/postgresql/.nix-profile | awk -F- '/gatekeeper/{print $NF}'
+              become: true
+              become_user: postgres
               register: gatekeeper_version
 
             - name: Write version file
diff --git a/nix/packages/build-ami/build-ami.sh b/nix/packages/build-ami/build-ami.sh
index 5148899095..001cd495ca 100644
--- a/nix/packages/build-ami/build-ami.sh
+++ b/nix/packages/build-ami/build-ami.sh
@@ -59,7 +59,7 @@ input_hash=${input_hash#/nix/store/}
 input_hash=${input_hash%%-*}
 
 # must run before the cd otherwise we get an error like `error: installable '/nix/store/...-amiSources' does not correspond to a Nix language value`
-site_env_path=$(nix eval --raw "github:supabase/postgres/$packages_git_sha#packages.$system.site-env-$postgres_major_version.outPath")
+nix_store_paths=$(cat "$(nix build --no-link --print-out-paths "github:supabase/postgres/$packages_git_sha#packages.$system.nix-store-paths-$postgres_major_version")")
 
 cd @amiSources@
 
@@ -139,8 +139,7 @@ echo "::group::AMI Build: Stage 2"
 
 packer build "${common_packer_args[@]}" \
 	-var "ami_name=$ami_name" \
-	-var "packages_git_sha=$packages_git_sha" \
-	-var "site_env_path=$site_env_path" \
+	-var "nix_store_paths=$nix_store_paths" \
 	-var "source_ami=$stage1_ami_id" \
 	packer/stage2-nix.pkr.hcl
 
diff --git a/nix/packages/build-qemu-image/build-qemu-image.sh b/nix/packages/build-qemu-image/build-qemu-image.sh
index fc672a2369..957d5bf54e 100644
--- a/nix/packages/build-qemu-image/build-qemu-image.sh
+++ b/nix/packages/build-qemu-image/build-qemu-image.sh
@@ -51,22 +51,21 @@ install --mode 644 "$vars" "$workdir/ovmf_vars.fd" # qemu writes to the vars pfl
 
 git_sha=${GIT_SHA:-$(git rev-parse HEAD)}
 system=$([[ $arch == arm64 ]] && echo aarch64-linux || echo x86_64-linux)
-site_env_path=$(nix eval --raw "github:supabase/postgres/$git_sha#packages.$system.site-env-$postgres_major_version.outPath")
 postgres_version=$(yq -er ".postgres_release.postgres$postgres_major_version" ansible/postgres_release.yml)
 
 # Build the cloud-init seed ISO before invoking packer.
 cloud-localds "$workdir/seeds-cloudimg.iso" user-data-cloudimg meta-data
 
+nix_store_paths=$(cat "$(nix build --no-link --print-out-paths "github:supabase/postgres/$git_sha#packages.$system.nix-store-paths-$postgres_major_version")")
 export LC_ALL=C.UTF-8
 export TZ=UTC
 packer init packer/qemu.pkr.hcl
 PACKER_LOG=${PACKER_LOG:-1} packer build \
 	-var "arch=$arch" \
 	-var "cpu=$cpu" \
-	-var "git_sha=$git_sha" \
 	-var "machine=$machine" \
+	-var "nix_store_paths=$nix_store_paths" \
 	-var "postgres-version=$postgres_version" \
-	-var "site_env_path=$site_env_path" \
 	-var "postgres_major_version=$postgres_major_version" \
 	-var "qemu_binary=$qemu" \
 	-var "workdir=$workdir" \
diff --git a/nix/packages/postgres-env.nix b/nix/packages/postgres-env.nix
index 0ae009fff7..64fc778e52 100644
--- a/nix/packages/postgres-env.nix
+++ b/nix/packages/postgres-env.nix
@@ -28,12 +28,31 @@
             self'.legacyPackages."psql_${version}".exts.orioledb.debug
           ];
         };
+
+      makeNixStorePaths =
+        version:
+        pkgs.writeText "nix-store-paths-${version}.json" (
+          builtins.toJSON {
+            inherit (self'.packages)
+              supascan
+              pgbouncer
+              pg-backrest
+              wal-g-2
+              wal-g-3
+              ;
+            postgres-env = self'.packages."postgres-env-${version}";
+            site-env = self'.packages."site-env-${version}";
+          }
+        );
     in
     {
       packages = {
         postgres-env-15 = makePostgresEnv "15";
         postgres-env-17 = makePostgresEnv "17";
         postgres-env-orioledb-17 = makePostgresEnv "orioledb-17";
+        nix-store-paths-15 = makeNixStorePaths "15";
+        nix-store-paths-17 = makeNixStorePaths "17";
+        nix-store-paths-orioledb-17 = makeNixStorePaths "orioledb-17";
       };
     };
 }
diff --git a/packer/qemu.pkr.hcl b/packer/qemu.pkr.hcl
index 42eaa21636..2c2c9d6935 100644
--- a/packer/qemu.pkr.hcl
+++ b/packer/qemu.pkr.hcl
@@ -1,10 +1,4 @@
-variable "git_sha" {
-  type = string
-}
-
-variable "site_env_path" {
-  type = string
-}
+variable "nix_store_paths" { type = map(string) }
 
 variable "postgres-version" {
   type    = string
@@ -112,8 +106,7 @@ build {
 
   provisioner "shell" {
     environment_vars = [
-      "GIT_SHA=${var.git_sha}",
-      "SITE_ENV_PATH=${var.site_env_path}",
+      "NIX_STORE_PATHS=${jsonencode({ nix_store_paths = var.nix_store_paths })}",
       "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}"
     ]
     use_env_var_file    = true
diff --git a/packer/scripts/nix-provision.sh b/packer/scripts/nix-provision.sh
index daa427d386..a91c212a21 100755
--- a/packer/scripts/nix-provision.sh
+++ b/packer/scripts/nix-provision.sh
@@ -50,7 +50,6 @@ function install_nix() {
 
 function execute_stage2_playbook {
 	echo "POSTGRES_MAJOR_VERSION: $POSTGRES_MAJOR_VERSION"
-	echo "GIT_SHA: $GIT_SHA"
 	mkdir -p /etc/ansible
 	tee /etc/ansible/ansible.cfg <<-EOF
 		[defaults]
@@ -64,8 +63,7 @@ function execute_stage2_playbook {
 
 	ansible-playbook /tmp/ansible-playbook/ansible/playbook.yml \
 		--extra-vars '{"stage2":true, "qemu":false}' \
-		--extra-vars "git_commit_sha=$GIT_SHA" \
-		--extra-vars "site_env_path=$SITE_ENV_PATH" \
+		--extra-vars "$NIX_STORE_PATHS" \
 		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION"
diff --git a/packer/scripts/qemu-bootstrap-nix.sh b/packer/scripts/qemu-bootstrap-nix.sh
index d4fdda6f98..43891f8276 100755
--- a/packer/scripts/qemu-bootstrap-nix.sh
+++ b/packer/scripts/qemu-bootstrap-nix.sh
@@ -160,8 +160,7 @@ function execute_stage2_playbook {
 	export ANSIBLE_LOG_PATH=/tmp/ansible.log && export ANSIBLE_REMOTE_TEMP=/tmp
 	ansible-playbook ./ansible/playbook.yml \
 		--extra-vars '{"stage2": true, "qemu": true}' \
-		--extra-vars "git_commit_sha=$GIT_SHA" \
-		--extra-vars "site_env_path=$SITE_ENV_PATH" \
+		--extra-vars "$NIX_STORE_PATHS" \
 		--extra-vars "postgresql_version=postgresql_$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "postgres_major_version=$POSTGRES_MAJOR_VERSION" \
 		--extra-vars "psql_version=psql_$POSTGRES_MAJOR_VERSION" \
diff --git a/packer/stage2-nix.pkr.hcl b/packer/stage2-nix.pkr.hcl
index dc89e03330..8914050771 100644
--- a/packer/stage2-nix.pkr.hcl
+++ b/packer/stage2-nix.pkr.hcl
@@ -6,17 +6,11 @@ variable "git-head-version" {
   type = string
 }
 
-variable "packages_git_sha" {
-  type = string
-}
-
 variable "packer-execution-id" {
   type = string
 }
 
-variable "site_env_path" {
-  type = string
-}
+variable "nix_store_paths" { type = map(string) }
 
 variable "postgres_major_version" {
   type = string
@@ -150,8 +144,7 @@ build {
 
   provisioner "shell" {
     environment_vars = [
-      "GIT_SHA=${var.packages_git_sha}",
-      "SITE_ENV_PATH=${var.site_env_path}",
+      "NIX_STORE_PATHS=${jsonencode({ nix_store_paths = var.nix_store_paths })}",
       "POSTGRES_MAJOR_VERSION=${var.postgres_major_version}"
     ]
     use_env_var_file = true