diff --git a/common.nix b/common.nix
index d18bbf6..ed68913 100644
--- a/common.nix
+++ b/common.nix
@@ -69,13 +69,13 @@ let
   # always evaluates on the machine it runs on (--build-host ships the
   # derivation, not the expression), so the only way to move eval off a client
   # is to run nix on the server over SSH and hand the resulting closure to
-  # --store-path, which skips eval and build entirely. Same lantian substituter
-  # as services/prebuild.nix, and --out-link keeps a gc root on the server so
-  # `clean` there can't reap the closure mid-copy. SSH and the copy run as
+  # --store-path, which skips eval and build entirely. --out-link keeps a gc
+  # root on the server so `clean` there can't reap the closure mid-copy.
+  # SSH and the copy run as
   # fred, not root: root has no key on the server, and require-sigs = false
   # below is a daemon setting, so the daemon takes the unsigned closure from an
   # untrusted user just fine. Only the activation needs sudo.
-  remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} --option extra-substituters https://attic.xuyh0120.win/lantian --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW --log-format internal-json 2>&1 | ${copyBar}/bin/nix-copy-bar && sudo nixos-rebuild switch --no-reexec --store-path $NEW && ${post}'";
+  remoteUpdate = "bash -c 'set -o pipefail && OLD_SYSTEM=$(readlink /run/current-system) && NEW=$(ssh fred@nordhammer.it \"nix build --refresh --print-out-paths --out-link prebuild-${config.networking.hostName} ${flake}#nixosConfigurations.${config.networking.hostName}.config.system.build.toplevel\") && nix copy --from ssh://fred@nordhammer.it $NEW --log-format internal-json 2>&1 | ${copyBar}/bin/nix-copy-bar && sudo nixos-rebuild switch --no-reexec --store-path $NEW && ${post}'";
 in
 {
   imports = [
diff --git a/hosts/hardware/FredOS-Gaming.nix b/hosts/hardware/FredOS-Gaming.nix
index fcc6663..37b93fb 100644
--- a/hosts/hardware/FredOS-Gaming.nix
+++ b/hosts/hardware/FredOS-Gaming.nix
@@ -8,16 +8,9 @@
   nixpkgs.overlays = [ inputs.nix-cachyos-kernel.overlays.pinned ];
   boot.kernelPackages = lib.mkForce pkgs.cachyosKernels.linuxPackages-cachyos-bore;
 
-  # garnix.io shut down July 2026; lantian's attic cache still serves the
-  # cachyos kernel builds.
-  nix.settings = {
-    substituters = [
-      "https://attic.xuyh0120.win/lantian"
-    ];
-    trusted-public-keys = [
-      "lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc="
-    ];
-  };
+  # No binary cache for the cachyos kernel: garnix.io shut down July 2026 and
+  # lantian's attic (and its signing key) was dropped after the October 2026
+  # server compromise (xddxdd/nix-cachyos-kernel#110). The server builds it.
 
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ "amdgpu" ];
diff --git a/services/prebuild.nix b/services/prebuild.nix
index 7c249b6..37c6335 100644
--- a/services/prebuild.nix
+++ b/services/prebuild.nix
@@ -52,14 +52,11 @@ let
       Type = "oneshot";
       StateDirectory = "prebuild";
     };
-    # Gaming's kernel comes from lantian's attic (see hosts/hardware/
-    # FredOS-Gaming.nix). That substituter isn't configured on this host, so
-    # without it the cachyos kernel gets built from source here instead of
-    # fetched — hours, not minutes. Harmless for the Macbook.
+    # Gaming's cachyos kernel has no binary cache any more (see hosts/
+    # hardware/FredOS-Gaming.nix), so a kernel bump builds from source here —
+    # hours, not minutes. That's what this nightly prebuild absorbs.
     script = ''
       ${config.nix.package}/bin/nix build --refresh \
-        --option extra-substituters https://attic.xuyh0120.win/lantian \
-        --option extra-trusted-public-keys lantian:EeAUQ+W+6r7EtwnmYjeVwx5kOGEBpjlBfPlzGlTNvHc= \
         --out-link /var/lib/prebuild/${host} \
         'git+https://forg.gregersen.it/rope/nixos#nixosConfigurations.${host}.config.system.build.toplevel'
     '';