diff --git a/effects.nix b/effects.nix
index 9cc2079..832e826 100644
--- a/effects.nix
+++ b/effects.nix
@@ -1,4 +1,4 @@
-{
+{self, ...}: {
   defaultEffectSystem = "aarch64-linux";
 
   hercules-ci = {
@@ -11,6 +11,8 @@
   herculesCI = {
     onPush = {
       default.enable = true;
+
+      wrappers.outputs = self.packages.aarch64-linux;
     };
   };
 }
diff --git a/hosts/kazuki/default.nix b/hosts/kazuki/default.nix
index d7bc7a1..9c1d694 100644
--- a/hosts/kazuki/default.nix
+++ b/hosts/kazuki/default.nix
@@ -26,5 +26,10 @@
     };
 
     common.hercules.enable = true;
+    age.secrets.kazuki-cachix = {
+      file = ../../secrets/kazuki-cachix.age;
+      owner = config.systemd.services.hercules-ci-agent.serviceConfig.User;
+    };
+    services.hercules-ci-agent.settings.binaryCachesPath = config.age.secrets.kazuki-cachix.path;
   };
 }
diff --git a/secrets/kazuki-cachix.age b/secrets/kazuki-cachix.age
new file mode 100644
index 0000000..c210043
Binary files /dev/null and b/secrets/kazuki-cachix.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 143e71a..68ddd3d 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -6,4 +6,5 @@ in {
   "vault-cert-env.age".publicKeys = [keys.system.kazuki keys.other.bootstrap];
   # "bitwarden-env-file.age".publicKeys = [keys.system.kazuki keys.other.bootstrap];
   "hercules-token.age".publicKeys = [keys.system.kazuki keys.other.bootstrap];
+  "kazuki-cachix.age".publicKeys = [keys.system.kazuki keys.other.bootstrap];
 }