diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 746641c8..199429a5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -46,7 +46,13 @@ oci-image:x86_64-unknown-linux-gnu:
   stage: artifacts
   image: nixos/nix:2.19.2
   script:
-    - nix build .#oci-image
+    # Push artifacts and build requirements to binary cache
+    #
+    # Since the OCI image package is based on the binary package, this has the
+    # fun side effect of uploading the normal binary too. Conduit users who are
+    # deploying with Nix can leverage this fact by adding our binary cache to
+    # their systems.
+    - ./bin/nix-build-and-cache .#oci-image
 
     # Make the output less difficult to find
     - cp result oci-image.tar.gz
diff --git a/bin/nix-build-and-cache b/bin/nix-build-and-cache
new file mode 100755
index 00000000..b37ebd85
--- /dev/null
+++ b/bin/nix-build-and-cache
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# The first argument must be the desired installable
+INSTALLABLE="$1"
+
+# Build the installable and forward any other arguments too
+nix build "$@"
+
+if [ ! -z ${ATTIC_TOKEN+x} ]; then
+
+nix run --inputs-from . attic -- login \
+    conduit \
+        https://nix.computer.surgery/conduit \
+        "$ATTIC_TOKEN"
+
+    push_args=(
+        # Attic and its build dependencies
+        "$(nix path-info --inputs-from . attic)"
+        "$(nix path-info --inputs-from . attic --derivation)"
+
+        # The target installable and its build dependencies
+        "$(nix path-info "$INSTALLABLE" --derivation)"
+        "$(nix path-info "$INSTALLABLE")"
+    )
+
+    nix run --inputs-from . attic -- push conduit "${push_args[@]}"
+else
+    echo "\$ATTIC_TOKEN is unset, skipping uploading to the binary cache"
+fi