diff --git a/modules/attic-image.nix b/images/attic.nix
similarity index 100%
rename from modules/attic-image.nix
rename to images/attic.nix
diff --git a/modules/dnsmasq-image.nix b/images/dnsmasq.nix
similarity index 100%
rename from modules/dnsmasq-image.nix
rename to images/dnsmasq.nix
diff --git a/kubenix.nix b/kubenix.nix
index 99021ef..debc874 100644
--- a/kubenix.nix
+++ b/kubenix.nix
@@ -11,9 +11,15 @@ inputs@{ self, servers, flutils, nixpkgs, kubenix, ... }: flutils.lib.eachDefaul
 
     mkKubernetes = name: module: namespace: (kubenix.evalModules.${system} {
       specialArgs = {
-        inherit namespace system machines;
+        inherit namespace system machines self;
         inherit (inputs) nixhelm blog-pim dns nixpkgs nixng;
         inherit (self) globals;
+
+        utils = import ./utils.nix {
+          inherit pkgs;
+          inherit (inputs) nixpkgs nixng;
+          inherit (self) globals;
+        };
       };
 
       module = { kubenix, ... }:
@@ -57,7 +63,7 @@ inputs@{ self, servers, flutils, nixpkgs, kubenix, ... }: flutils.lib.eachDefaul
                 k8sMachines = lib.filterAttrs (n: m: m.kubernetesNodeLabels != null) machines;
                 k8sServerNames = builtins.concatStringsSep " " (builtins.attrNames k8sMachines);
               in
-              ''
+                /* bash */ ''
                 wrapProgram $out/bin/applyset-deploy.sh \
                   --suffix PATH : "$out/bin" \
                   --run 'export KUBECONFIG=''${KUBECONFIG:-${toString kubeconfig}}' \
diff --git a/modules/attic.nix b/modules/attic.nix
index 8770375..2c124c0 100644
--- a/modules/attic.nix
+++ b/modules/attic.nix
@@ -1,21 +1,4 @@
-{ nixpkgs, pkgs, lib, nixng, config, globals, ... }:
-let
-
-  atticStream = (import ./attic-image.nix {
-    inherit nixpkgs nixng globals;
-    inherit (nixng) nglib;
-  }).config.system.build.ociImage.stream;
-
-  atticImage = pkgs.stdenv.mkDerivation {
-    name = "attic.tar";
-    src = atticStream;
-    dontUnpack = true;
-    buildPhase = ''
-      $src > $out
-    '';
-  };
-in
-{
+{ self, utils, lib, config, globals, ... }: {
   options.attic.enable = lib.mkEnableOption "attic";
 
   config = lib.mkIf config.attic.enable {
@@ -52,7 +35,7 @@ in
 
             spec = {
               containers.attic = {
-                image = "nix:0${atticImage}";
+                image = utils.nixSnapshotterRef (utils.mkNixNGImage "attic" "${self}/images/attic.nix");
                 ports.web.containerPort = 8080;
 
                 env = {
diff --git a/modules/dnsmasq.nix b/modules/dnsmasq.nix
index 6e8f8a8..b287cac 100644
--- a/modules/dnsmasq.nix
+++ b/modules/dnsmasq.nix
@@ -1,20 +1,4 @@
-{ nixpkgs, pkgs, nixng, globals, config, lib, ... }:
-let
-  dnsmasqStream = (import ./dnsmasq-image.nix {
-    inherit nixpkgs nixng globals;
-    inherit (nixng) nglib;
-  }).config.system.build.ociImage.stream;
-
-  dnsmasqImage = pkgs.stdenv.mkDerivation {
-    name = "dnsmasq.tar";
-    src = dnsmasqStream;
-    dontUnpack = true;
-    buildPhase = ''
-      $src > $out
-    '';
-  };
-in
-{
+{ self, utils, globals, config, lib, ... }: {
   options.dnsmasq.enable = lib.mkEnableOption "dnsmasq";
 
   config = lib.mkIf config.dnsmasq.enable {
@@ -26,7 +10,7 @@ in
           metadata.labels.app = "dnsmasq";
 
           spec.containers.dnsmasq = {
-            image = "nix:0${dnsmasqImage}";
+            image = utils.nixSnapshotterRef (utils.mkNixNGImage "dnsmasq" "${self}/images/dnsmasq.nix");
             imagePullPolicy = "Always";
 
             ports.dns = {
diff --git a/utils.nix b/utils.nix
new file mode 100644
index 0000000..8b05d75
--- /dev/null
+++ b/utils.nix
@@ -0,0 +1,19 @@
+{ pkgs, nixpkgs, nixng, globals, ... }: {
+  mkNixNGImage = name: file:
+    let
+      stream = (import file {
+        inherit nixpkgs nixng globals;
+        inherit (nixng) nglib;
+      }).config.system.build.ociImage.stream;
+    in
+    pkgs.stdenv.mkDerivation {
+      name = "${name}.tar";
+      src = stream;
+      dontUnpack = true;
+      buildPhase = ''
+        $src > $out
+      '';
+    };
+
+  nixSnapshotterRef = imagePath: "nix:0${imagePath}";
+}