diff --git a/nix/os/devices/steveej-t14/system.nix b/nix/os/devices/steveej-t14/system.nix
index 9ced0b4..3f4763c 100644
--- a/nix/os/devices/steveej-t14/system.nix
+++ b/nix/os/devices/steveej-t14/system.nix
@@ -11,10 +11,12 @@ in {
   nix.settings = {
     substituters = [
       "https://holochain-ci.cachix.org"
-      "https://cache.holo.host/"
+      "https://holochain-ci-internal.cachix.org"
+      # "https://cache.holo.host/"
     ];
     trusted-public-keys = [
       "holochain-ci.cachix.org-1:5IUSkZc0aoRS53rfkvH9Kid40NpyjwCMCzwRTXy+QN8="
+      "holochain-ci-internal.cachix.org-1:QvVsSrTiearCjrLTVtNtJOdQCDTseXh7UXUuSMx46NE="
       "cache.holo.host-1:lNXIXtJgS9Iuw4Cu6X0HINLu9sTfcjEntnrgwMQIMcE="
       "cache.holo.host-2:ZJCkX3AUYZ8soxTLfTb60g+F3MkWD7hkH9y8CgqwhDQ="
     ];
@@ -46,6 +48,9 @@ in {
 
     # iperf3
     5201
+
+    # used on holochain hackathon for cache reverse proxy
+    80
   ];
   networking.firewall.interfaces."eth+".allowedUDPPorts = [
     # syncthing
@@ -53,6 +58,11 @@ in {
     21027
   ];
 
+  networking.firewall.interfaces."wlan+".allowedTCPPorts = [
+    # used on holochain hackathon for cache reverse proxy
+    80
+  ];
+
   networking.firewall.logRefusedConnections = false;
   networking.usePredictableInterfaceNames = false;