diff --git a/.ci/master.yaml b/.ci/master.yaml
index b2d5b90d..f6380b5b 100644
--- a/.ci/master.yaml
+++ b/.ci/master.yaml
@@ -24,7 +24,33 @@ spec:
           value: $(params.git_url)
         - name: revision
           value: $(params.git_revision)
+    - name: tools
+      runAfter:
+        - clone
+      taskRef:
+        resolver: hub
+        params:
+          - name: kind
+            value: task
+          - name: name
+            value: kaniko
+          - name: version
+            value: "0.6"
+      params:
+        - name: DOCKERFILE
+          value: ./Dockerfile.tools
+        - name: IMAGE
+          value: &toolsImage registry.khuedoan.com/homelab-tools:$(params.git_revision)
+        - name: EXTRA_ARGS
+          value:
+            - --cache=true
+      workspaces:
+        - name: source
+          workspace: shared-data
     - name: test
+      runAfter:
+        - clone
+        - tools
       workspaces:
         - name: source
           workspace: shared-data
@@ -32,14 +58,12 @@ spec:
         workspaces:
           - name: source
         stepTemplate:
-          image: nixos/nix:latest
-          workingDir: /workspace/source
+          image: *toolsImage
+          workingDir: $(workspaces.source.path)
         steps:
-          # TODO optimize Nix cache, this is too slow
           - name: pre-commit
             command:
               - nix-shell
               - --command
             args:
               - "pre-commit run --color=always"
-          # TODO run more tests here
diff --git a/.ci/pull-request.yaml b/.ci/pull-request.yaml
index 61073952..8e73acc6 100644
--- a/.ci/pull-request.yaml
+++ b/.ci/pull-request.yaml
@@ -24,7 +24,33 @@ spec:
           value: $(params.git_url)
         - name: revision
           value: $(params.git_revision)
+    - name: tools
+      runAfter:
+        - clone
+      taskRef:
+        resolver: hub
+        params:
+          - name: kind
+            value: task
+          - name: name
+            value: kaniko
+          - name: version
+            value: "0.6"
+      params:
+        - name: DOCKERFILE
+          value: ./Dockerfile.tools
+        - name: IMAGE
+          value: &toolsImage registry.khuedoan.com/homelab-tools:$(params.git_revision)
+        - name: EXTRA_ARGS
+          value:
+            - --cache=true
+      workspaces:
+        - name: source
+          workspace: shared-data
     - name: test
+      runAfter:
+        - clone
+        - tools
       workspaces:
         - name: source
           workspace: shared-data
@@ -32,10 +58,9 @@ spec:
         workspaces:
           - name: source
         stepTemplate:
-          image: nixos/nix:latest
-          workingDir: /workspace/source
+          image: *toolsImage
+          workingDir: $(workspaces.source.path)
         steps:
-          # TODO optimize Nix cache, this is too slow
           - name: pre-commit
             command:
               - nix-shell
diff --git a/Dockerfile.tools b/Dockerfile.tools
new file mode 100644
index 00000000..d33b7891
--- /dev/null
+++ b/Dockerfile.tools
@@ -0,0 +1,5 @@
+FROM nixos/nix
+
+COPY shell.nix shell.nix
+
+RUN nix-shell --command exit