diff --git a/services/hydra/default.nix b/services/hydra/default.nix
index 6ec4595..6c9a37d 100644
--- a/services/hydra/default.nix
+++ b/services/hydra/default.nix
@@ -11,13 +11,15 @@ let
     lib.mapAttrsToList (k: v: "${k}=${v}") settings
     );
 
-  mkBaremetalBuilder = { nrCores, publicHostKey, host, speedFactor ? 1, user ? "builder", supportedSystems ? [ "i686-linux" "x86_64-linux" ], supportedFeatures ? [ "big-parallel" "kvm" "nixos-test" ] }: 
-  "ssh://${user}@${host} ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString nrCores} ${toString speedFactor} ${lib.concatStringsSep "," supportedFeatures} - ${publicHostKey}";
+  # XXX: to support Nix's dumb public host key syntax (base64'd), this outputs
+  # a string with shell-style command interpolations: $(...).
+  mkBaremetalBuilder = { nrCores, publicHostKey, host, speedFactor ? 1, user ? "builder", supportedSystems ? [ "i686-linux" "x86_64-linux" ], supportedFeatures ? [ "big-parallel" "kvm" "nixos-test" ] }:
+  "ssh://${user}@${host} ${lib.concatStringsSep "," supportedSystems} ${config.age.secrets.hydra-ssh-key-priv.path} ${toString nrCores} ${toString speedFactor} ${lib.concatStringsSep "," supportedFeatures} - $(echo -n '${publicHostKey}' | base64 -w0)";
 
   # TODO:
   # - generalize to new architectures
   # - generalize to new features
-  baremetalBuilders = lib.concatStringsSep "\n" 
+  baremetalBuilders = lib.concatStringsSep "\n"
     (map (n: mkBaremetalBuilder {
       nrCores = 40; # TODO: do not hardcode this, use the node's builder configuration.
       publicHostKey = ssh-keys.machines.${n};
@@ -76,7 +78,11 @@ in {
       package = pkgs.hydra;
 
       buildMachinesFiles = [
-        (pkgs.writeText "hydra-builders.conf" baremetalBuilders)
+        (pkgs.runCommandNoCC "hydra-builders.conf" {} ''
+          cat >$out <<EOF
+          ${baremetalBuilders}
+          EOF
+        '')
       ];
 
       extraConfig = ''