diff --git a/.github/workflows/check-code.yml b/.github/workflows/check-code.yml
index 6370fd928..cf1e1448f 100644
--- a/.github/workflows/check-code.yml
+++ b/.github/workflows/check-code.yml
@@ -12,6 +12,10 @@ jobs:
     name: Check Code
     runs-on: ubuntu-latest
     steps:
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v4
+      - name: Run the Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@v2
       - uses: actions/checkout@v3
       - name: Run check code
-        run: make check-code
+        run: nix develop -c make check-code
diff --git a/.github/workflows/vendor/rust-check-code.yml b/.github/workflows/vendor/rust-check-code.yml
index 6370fd928..cf1e1448f 100644
--- a/.github/workflows/vendor/rust-check-code.yml
+++ b/.github/workflows/vendor/rust-check-code.yml
@@ -12,6 +12,10 @@ jobs:
     name: Check Code
     runs-on: ubuntu-latest
     steps:
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v4
+      - name: Run the Magic Nix Cache
+        uses: DeterminateSystems/magic-nix-cache-action@v2
       - uses: actions/checkout@v3
       - name: Run check code
-        run: make check-code
+        run: nix develop -c make check-code
diff --git a/ci/vendir.lock.yml b/ci/vendir.lock.yml
index 2e5acc07a..b67d2a69b 100644
--- a/ci/vendir.lock.yml
+++ b/ci/vendir.lock.yml
@@ -2,14 +2,14 @@ apiVersion: vendir.k14s.io/v1alpha1
 directories:
 - contents:
   - git:
-      commitTitle: 'feat: allow public or private repo selection (#34)'
-      sha: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      commitTitle: 'fix: check-code executable'
+      sha: cfd07211efb7ef9c986020d1d24069c820fd1717
     path: .
   path: ../.github/workflows/vendor
 - contents:
   - git:
-      commitTitle: 'feat: allow public or private repo selection (#34)'
-      sha: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      commitTitle: 'fix: check-code executable'
+      sha: cfd07211efb7ef9c986020d1d24069c820fd1717
     path: .
-  path: ./vendor
+  path: vendor
 kind: LockConfig
diff --git a/ci/vendir.yml b/ci/vendir.yml
index 49e8e5ad2..14f82bd5a 100644
--- a/ci/vendir.yml
+++ b/ci/vendir.yml
@@ -8,7 +8,7 @@ directories:
   - path: . # Copy this folder out to ..
     git:
       url: https://github.com/GaloyMoney/concourse-shared.git
-      ref: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      ref: cfd07211efb7ef9c986020d1d24069c820fd1717
     includePaths:
     - shared/actions/*
     excludePaths:
@@ -20,7 +20,7 @@ directories:
   - path: .
     git:
       url: https://github.com/GaloyMoney/concourse-shared.git
-      ref: 53fc9dd805d3574d200e8e6e99f856c0912b52a8
+      ref: cfd07211efb7ef9c986020d1d24069c820fd1717
     includePaths:
     - shared/ci/**/*
     excludePaths:
diff --git a/ci/vendor/pipeline-fragments.lib.yml b/ci/vendor/pipeline-fragments.lib.yml
index 5bb6ab163..db93433d0 100644
--- a/ci/vendor/pipeline-fragments.lib.yml
+++ b/ci/vendor/pipeline-fragments.lib.yml
@@ -44,6 +44,12 @@ source:
   repository: #@ release_concourse_image()
 #@ end
 
+#@ def nix_task_image_config():
+type: registry-image
+source:
+  repository: nixpkgs/nix-flakes
+#@ end
+
 #@ def slack_failure_notification():
 #@ fail_url = "<$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME| :face_with_symbols_on_mouth: $BUILD_JOB_NAME> failed!"
 put: slack
@@ -54,6 +60,25 @@ params:
   text:    #@ fail_url
 #@ end
 
+#@ def check_code():
+name: check-code
+serial: true
+plan:
+- in_parallel:
+  - { get: repo, trigger: true }
+  - { get: pipeline-tasks }
+- task: check-code
+  config:
+    platform: linux
+    image_resource: #@ nix_task_image_config()
+    inputs:
+    - name: pipeline-tasks
+    - name: repo
+    run:
+      path: pipeline-tasks/ci/vendor/tasks/check-code.sh
+on_failure: #@ slack_failure_notification()
+#@ end
+
 #@ def nodejs_check_code():
 name: check-code
 serial: true
@@ -265,21 +290,27 @@ plan:
     run:
       path: pipeline-tasks/ci/vendor/tasks/docker-prep-docker-build-env.sh
 - task: build
-  privileged: true
   config:
     platform: linux
     image_resource:
       type: registry-image
       source:
-        repository: vito/oci-build-task
+        repository: gcr.io/kaniko-project/executor
+        tag: debug
     inputs:
     - name: repo
     outputs:
     - name: image
-    params:
-      CONTEXT: repo
     run:
-      path: build
+      path: /kaniko/executor
+      args:
+        - --dockerfile=Dockerfile
+        - --context=repo
+        - --use-new-run
+        - --single-snapshot
+        - --cache=false
+        - --no-push
+        - --tar-path=image/image.tar
 - put: edge-image
   params:
     image: image/image.tar
@@ -370,6 +401,7 @@ plan:
       platform: linux
       image_resource: #@ nodejs_task_image_config()
       inputs:
+        - name: repo
         - name: pipeline-tasks
         - name: edge-image
         - name: charts-repo
@@ -413,7 +445,7 @@ source:
   tag: edge
   username: #@ data.values.docker_registry_user
   password: #@ data.values.docker_registry_password
-  repository: #@ public_docker_registry() if publicRepo else private_docker_registry() + "/" + data.values.gh_repository
+  repository: #@ public_docker_registry() + "/" + data.values.gh_repository if publicRepo else private_docker_registry() + "/" + data.values.gh_repository
 #@ end
 
 #@ def nodejs_deps_resource(webhook = False):
@@ -477,13 +509,13 @@ source:
   private_key: #@ data.values.github_private_key
 #@ end
 
-#@ def versioned_image_resource():
+#@ def versioned_image_resource(publicRepo = True):
 name: versioned-image
 type: registry-image
 source:
   username: #@ data.values.docker_registry_user
   password: #@ data.values.docker_registry_password
-  repository: #@ public_docker_registry() + "/" + data.values.gh_repository
+  repository: #@ public_docker_registry() + "/" + data.values.gh_repository if publicRepo else private_docker_registry() + "/" + data.values.gh_repository
 #@ end
 
 #@ def gh_release_resource():
diff --git a/ci/vendor/tasks/chart-open-charts-pr.sh b/ci/vendor/tasks/chart-open-charts-pr.sh
index 6acf1e03f..4803ce427 100755
--- a/ci/vendor/tasks/chart-open-charts-pr.sh
+++ b/ci/vendor/tasks/chart-open-charts-pr.sh
@@ -6,12 +6,15 @@
 set -eu
 
 export digest=$(cat ./edge-image/digest)
+export ref=$(cat ./repo/.git/short_ref)
 
 pushd charts-repo
 
-ref=$(yq e '.image.git_ref' charts/${CHARTS_SUBDIR}/values.yaml)
 git checkout ${BRANCH}
-old_ref=$(yq e '.image.git_ref' charts/${CHARTS_SUBDIR}/values.yaml)
+
+old_digest=$(yq e '.image.digest' "./charts/${CHARTS_SUBDIR}/values.yaml")
+old_ref=$(grep "digest: \"${old_digest}\"" "./charts/${CHARTS_SUBDIR}/values.yaml" \
+  | sed -n 's/.*commit_ref=\([^;]*\);.*/\1/p' | tr -d ' \n')
 
 cat <<EOF >> ../body.md
 # Bump ${CHARTS_SUBDIR} image
diff --git a/ci/vendor/tasks/check-code.sh b/ci/vendor/tasks/check-code.sh
new file mode 100755
index 000000000..2dcd1948c
--- /dev/null
+++ b/ci/vendor/tasks/check-code.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+#! Auto synced from Shared CI Resources repository
+#! Don't change this file, instead change it in github.com/GaloyMoney/concourse-shared
+
+set -eu
+
+pushd repo
+
+nix develop -c make check-code
diff --git a/ci/vendor/tasks/docker-bump-image-digest.sh b/ci/vendor/tasks/docker-bump-image-digest.sh
index f47ad5229..2616b7bc9 100755
--- a/ci/vendor/tasks/docker-bump-image-digest.sh
+++ b/ci/vendor/tasks/docker-bump-image-digest.sh
@@ -12,7 +12,9 @@ export app_version=$(cat version/version)
 pushd charts-repo
 
 yq -i e '.image.digest = strenv(digest)' ./charts/${CHARTS_SUBDIR}/values.yaml
-yq -i e '.image.git_ref = strenv(ref)' ./charts/${CHARTS_SUBDIR}/values.yaml
+
+sed -i "s|\(digest: \"${digest}\"\).*$|\1 # METADATA:: repository=https://github.com/GaloyMoney/${CHARTS_SUBDIR};commit_ref=${ref};app=${CHARTS_SUBDIR};|g" "./charts/${CHARTS_SUBDIR}/values.yaml"
+
 yq -i e '.appVersion = strenv(app_version)' ./charts/${CHARTS_SUBDIR}/Chart.yaml
 
 if [[ -z $(git config --global user.email) ]]; then