For security, you want to only do this with content addressed builds. We have a company nix cache on S3 overlaid on top of upstream nixpkgs cache where only th

For security, you want to only do this with content addressed builds. We have a company nix cache on S3 overlaid on top of upstream nixpkgs cache where only the CICD is allowed to push/update the cache. Employee computers are all read-only. Works great!