--- a/crates/fleet-base/src/host.rs
+++ b/crates/fleet-base/src/host.rs
@@ -23,7 +23,7 @@
 use remowt_ui_prompt::{PrependSourcePrompter, Source};
 use tempfile::NamedTempFile;
 use tokio::{sync::OnceCell, task::spawn_blocking};
-use tracing::{info, warn};
+use tracing::{info, instrument, warn};
 
 use crate::fleetdata::{
 	FleetData, FleetSecretData, FleetSecretDistribution, FleetSecretPart, SecretOwner,
@@ -111,8 +111,8 @@
 
 	// TODO: Move command helpers away with connectivity refactor
 	pub local: bool,
-	pub remowt: OnceLock<Remowt>,
-	nix_store: OnceLock<Arc<Store>>,
+	pub remowt: OnceCell<Remowt>,
+	nix_store: OnceCell<Arc<Store>>,
 	nix_plugin: OnceCell<()>,
 }
 
@@ -132,10 +132,12 @@
 }
 
 enum RemoteDerivationMode {
+	/// Closure is (pre)signed, remote host is expected to trust our signatures.
 	CopySigned,
-	Copy,
-	Attic,
-	Cachix,
+	/// Closure is not signed, using escalated nix daemon to bypass signature verification.
+	CopyPrivileged,
+	/// Closure is uploaded to attic, remote host is expected to trust its signature.
+	Attic { name: String },
 }
 
 impl ConfigHost {
@@ -181,10 +183,7 @@
 			Ok(DeployKind::Fleet)
 		}).await.copied()
 	}
-	async fn connection(&self) -> Result<Remowt> {
-		if let Some(conn) = self.remowt.get() {
-			return Ok(conn.clone());
-		}
+	async fn new_remowt(&self) -> Result<Remowt> {
 		let bundle = agent_bundle()?;
 		let conn = if self.local {
 			Remowt::connect_local(&bundle, "remowt-fleet".to_owned())
@@ -213,13 +212,15 @@
 			description: "".to_owned(),
 		})
 		.register_endpoints(&mut conn.rpc());
-		let _ = self.remowt.set(conn);
-		Ok(self.remowt.get().expect("just set").clone())
+		Ok(conn)
 	}
 
 	/// Client for this host's unprivileged agent.
 	pub async fn remowt(&self) -> Result<Remowt> {
-		self.connection().await
+		self.remowt
+			.get_or_try_init(|| self.new_remowt())
+			.await
+			.cloned()
 	}
 
 	pub async fn nix_client(&self) -> Result<NixClient<BifConfig>> {
@@ -254,22 +255,24 @@
 		})
 	}
 
-	async fn nix_store(&self) -> Result<Arc<Store>> {
-		if let Some(store) = self.nix_store.get() {
-			return Ok(store.clone());
-		}
-		let conn = self.connection().await?;
+	async fn new_nix_store(&self) -> Result<Store> {
+		let conn = self.remowt().await?;
 		let socket = match self.deploy_kind().await? {
 			DeployKind::NixosInstall => {
 				remowt_fleet::nix_store_socket(conn, "/mnt?require-sigs=false").await?
 			}
 			_ => remowt_fleet::nix_store_socket(conn, "auto").await?,
 		};
+		// TODO: Utf8Path
 		let uri = format!("unix://{}", socket.display());
-		let store = Arc::new(Store::open(&uri)?);
-		let _ = self.nix_store.set(store);
-		Ok(self.nix_store.get().expect("just set").clone())
+		Store::open(&uri)
 	}
+	async fn nix_store(&self) -> Result<Arc<Store>> {
+		self.nix_store
+			.get_or_try_init(async || Ok(Arc::new(self.new_nix_store().await?)))
+			.await
+			.cloned()
+	}
 
 	pub async fn decrypt(&self, data: SecretData) -> Result<Vec<u8>> {
 		ensure!(data.encrypted, "secret is not encrypted");
@@ -335,8 +338,9 @@
 		Ok(data)
 	}
 	/// Returns path for futureproofing, as path might change i.e on conversion to CA
-	pub async fn remote_derivation(&self, path: impl AsRef<Utf8Path>) -> Result<Utf8PathBuf> {
-		let path = path.as_ref().to_owned();
+	#[instrument(skip(self))]
+	pub async fn remote_derivation(&self, path: &Utf8Path) -> Result<Utf8PathBuf> {
+		let path = path.to_owned();
 		if self.local {
 			// Path is located locally, thus already trusted.
 			return Ok(path);
@@ -502,8 +506,8 @@
 					pkgs_override: Some(self.default_pkgs.clone()),
 
 					local: true,
-					remowt: OnceLock::new(),
-					nix_store: OnceLock::new(),
+					remowt: OnceCell::new(),
+					nix_store: OnceCell::new(),
 					nix_plugin: OnceCell::new(),
 					deploy_kind: OnceCell::new(),
 					session_destination: OnceLock::new(),
@@ -545,8 +549,8 @@
 
 			// TODO: Remove with connectivit refactor
 			local: self.localhost == name,
-			remowt: OnceLock::new(),
-			nix_store: OnceLock::new(),
+			remowt: OnceCell::new(),
+			nix_store: OnceCell::new(),
 			nix_plugin: OnceCell::new(),
 			deploy_kind: OnceCell::new(),
 			session_destination: OnceLock::new(),
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -7,7 +7,7 @@
   remowt-agents-bundle = callPackage ./remowt-agents-bundle.nix { inherit craneLib; };
 in
 {
-  fleet = callPackage ./fleet.nix { inherit craneLib inputs; };
+  fleet = callPackage ./fleet.nix { inherit craneLib inputs remowt-agents-bundle; };
   fleet-install-secrets = callPackage ./fleet-install-secrets.nix { inherit craneLib; };
   fleet-generator-helper = callPackage ./fleet-generator-helper.nix { inherit craneLib; };