diff --git a/services/neko.nix b/services/neko.nix
index 1a455f1..a802b39 100644
--- a/services/neko.nix
+++ b/services/neko.nix
@@ -14,6 +14,20 @@
 # (graphics + video) are the first thing to check — verify with:
 #   docker run --rm --device=nvidia.com/gpu=all neko-gw:local nvidia-smi
 { config, pkgs, lib, ... }:
+let
+  # Wine-enabled image definition. Fed to `docker build` over stdin (see below)
+  # so there's no build context — we have no COPY/ADD, and a Nix-store symlinked
+  # context dir breaks BuildKit's Dockerfile resolution.
+  dockerfile = pkgs.writeText "neko-gw.Dockerfile" ''
+    FROM ghcr.io/m1k1o/neko/nvidia-xfce:latest
+    USER root
+    RUN dpkg --add-architecture i386 \
+     && apt-get update \
+     && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
+          wine wine64 wine32 winbind cabextract winetricks ca-certificates wget \
+     && rm -rf /var/lib/apt/lists/*
+  '';
+in
 {
   config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
 
@@ -26,17 +40,6 @@
       "d /var/lib/neko/home 0755 root root -"
     ];
 
-    # Dockerfile for the Wine-enabled image, built on first start (see below).
-    environment.etc."neko-gw/Dockerfile".text = ''
-      FROM ghcr.io/m1k1o/neko/nvidia-xfce:latest
-      USER root
-      RUN dpkg --add-architecture i386 \
-       && apt-get update \
-       && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
-            wine wine64 wine32 winbind cabextract winetricks ca-certificates wget \
-       && rm -rf /var/lib/apt/lists/*
-    '';
-
     systemd.services.neko = {
       description = "Neko — Guild Wars in a browser (Xfce + Wine + NVIDIA)";
       after = [ "docker.service" "network-online.target" ];
@@ -55,7 +58,9 @@
         TimeoutStartSec = "3600";
         ExecStartPre = [
           "-${pkgs.docker}/bin/docker rm -f neko"
-          "${pkgs.docker}/bin/docker build -t neko-gw:local /etc/neko-gw"
+          "${pkgs.writeShellScript "neko-build" ''
+            exec ${pkgs.docker}/bin/docker build -t neko-gw:local - < ${dockerfile}
+          ''}"
         ];
         # Wrapped in a shell script so the ICE-server JSON survives quoting
         # (systemd's own ExecStart parser would strip the inner double quotes).