diff --git a/radiantwave-updater.nix b/radiantwave-updater.nix
index af27ef7..008de79 100644
--- a/radiantwave-updater.nix
+++ b/radiantwave-updater.nix
@@ -56,10 +56,15 @@ in
           exit 0
         fi
 
-        # Fetch the closure from the signed Attic cache only. This never
-        # builds from source; it fails outright if the path isn't there.
+        # Realize the closure via the machine's substituters. The app itself
+        # only exists in the dev Attic cache, but nixpkgs deps (e.g. sqlite)
+        # are signed by cache.nixos.org and Attic intentionally skips them to
+        # avoid re-uploading the world. Fetch those from cache.nixos.org so
+        # the whole closure resolves without ever building from source.
         echo "radiantwave-updater: acquiring ''${NEW_PATH}"
-        ${pkgs.nix}/bin/nix copy --from "${cfg.atticUrl}" "$NEW_PATH" || {
+        ${pkgs.nix}/bin/nix-store -r "$NEW_PATH" \
+          --option extra-substituters "https://attic.radiantwavetech.com/radiantwave-dev https://cache.nixos.org" \
+          --option extra-trusted-public-keys "radiantwave-dev:B8FhLu3MQ9JfeEIHIKNrKxnP+3akzzkqMbTZR4hRfj0= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" || {
           echo "radiantwave-updater: nix copy failed for ''${NEW_PATH}"
           exit 1
         }