diff --git a/WORKSPACE b/WORKSPACE
index cabd7d78..2b634063 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -53,9 +53,9 @@ container_repositories()
 # Nix rules
 http_archive(
     name = "io_tweag_rules_nixpkgs",
-    strip_prefix = "rules_nixpkgs-364adc70f32c2b3982995fce06b334f4d159070e",
-    urls = ["https://github.com/tweag/rules_nixpkgs/archive/364adc70f32c2b3982995fce06b334f4d159070e.tar.gz"],
-    sha256 = "59cdaf64efe9391152564ccb670bd6976168fe1426ae8b9b2f676caef03a6849",
+    strip_prefix = "rules_nixpkgs-33c50ba64c11dddb95823d12f6b1324083cc5c43",
+    urls = ["https://github.com/tweag/rules_nixpkgs/archive/33c50ba64c11dddb95823d12f6b1324083cc5c43.tar.gz"],
+    sha256 = "91fedd5151bbd9ef89efc39e2172921bd7036c68cff54712a5df8ddf62bd6922",
 )
 
 # Nix packages
diff --git a/cluster/tools/BUILD b/cluster/tools/BUILD
index 974463db..de5c5b7a 100644
--- a/cluster/tools/BUILD
+++ b/cluster/tools/BUILD
@@ -31,15 +31,9 @@ copy_go_binary(
     visibility = ["//visibility:public"],
 )
 
-copy_go_binary(
-	name = "nixops.bin",
-    src = "@nixops//:bin",
-    visibility = ["//visibility:public"],
-)
-
 sh_binary(
     name = "nixops",
     srcs = ["nixops.sh"],
-    data = [":nixops.bin", "//tools:secretstore"],
+    data = ["@nixops//:bin", "//tools:secretstore"],
 )
 
diff --git a/cluster/tools/nixops.sh b/cluster/tools/nixops.sh
index f3848d23..e8109729 100755
--- a/cluster/tools/nixops.sh
+++ b/cluster/tools/nixops.sh
@@ -19,4 +19,4 @@ export GCE_PROJECT="hscloud"
 export GCE_SERVICE_ACCOUNT="nixops@hscloud.iam.gserviceaccount.com"
 export ACCESS_KEYPATH="$hscloud_root/gcp/secrets/plain/sa.pem"
 
-nixops.bin "$@"
+./external/nixops/bin/nixops "$@"