diff --git a/pkgs/ccache.nix b/pkgs/ccache.nix
new file mode 100644
index 0000000..9f4243c
--- /dev/null
+++ b/pkgs/ccache.nix
@@ -0,0 +1,71 @@
+{ pkgs
+, pkgs'
+, lib
+, ... }:
+
+let
+  # there are few direct hits with the linux kernel, so use CCACHE_NODIRECT
+  # (direct hits are file-based, non-direct are preprocessed file-based)
+  ccacheVars = {
+    CCACHE_CPP2 = "yes";
+    CCACHE_COMPRESS = "1";
+    CCACHE_UMASK = "007";
+    CCACHE_DIR = "/var/cache/ccache";
+    CCACHE_SLOPPINESS = "include_file_mtime,time_macros";
+    CCACHE_NODIRECT = "1";
+  };
+
+  buildCachedFirefox = useSccache: unwrapped:
+    (unwrapped.override {
+      buildMozillaMach = x: pkgs'.buildMozillaMach (x // {
+        extraConfigureFlags = (x.extraConfigureFlags or [])
+          ++ lib.toList (if useSccache then "--with-ccache=sccache" else "--with-ccache");
+      });
+    }).overrideAttrs (prev: if useSccache then {
+      nativeBuildInputs = (prev.nativeBuildInputs or []) ++ [ pkgs'.sccache ];
+      SCCACHE_DIR = "/var/cache/sccache";
+      SCCACHE_MAX_FRAME_LENGTH = "104857600";
+      RUSTC_WRAPPER = "${pkgs'.sccache}/bin/sccache";
+    } else ccacheVars // {
+      nativeBuildInputs = (prev.nativeBuildInputs or []) ++ [ pkgs'.ccache ];
+    });
+
+  ccacheConfig = ''
+    ${builtins.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "export ${k}=${v}") ccacheVars)}
+    if [ ! -d "$CCACHE_DIR" ]; then
+      echo "====="
+      echo "Directory '$CCACHE_DIR' does not exist"
+      echo "Please create it with:"
+      echo "  sudo mkdir -m0770 '$CCACHE_DIR'"
+      echo "  sudo chown root:nixbld '$CCACHE_DIR'"
+      echo "====="
+      exit 1
+    fi
+    if [ ! -w "$CCACHE_DIR" ]; then
+      echo "====="
+      echo "Directory '$CCACHE_DIR' is not accessible for user $(whoami)"
+      echo "Please verify its access permissions"
+      echo "====="
+      exit 1
+    fi
+  '';
+
+  overrides = { extraConfig = ccacheConfig; };
+
+  cacheStdenv = pkgs: pkgs.ccacheStdenv.override overrides;
+
+in {
+  # read by system/modules/ccache.nix
+  __dontIncludeCcacheOverlay = true;
+  ccacheWrapper = pkgs.ccacheWrapper.override overrides;
+
+  buildFirefoxWithCcache = buildCachedFirefox false;
+  buildFirefoxWithSccache = buildCachedFirefox true;
+
+  buildLinuxWithCcache = linux: linux.override {
+    stdenv = cacheStdenv pkgs';
+    buildPackages = pkgs'.buildPackages // {
+      stdenv = cacheStdenv pkgs'.buildPackages;
+    };
+  };
+}
diff --git a/pkgs/default.nix b/pkgs/default.nix
index e8d4c89..03368c4 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -10,24 +10,6 @@ let
     inherit (pkgs) fetchgit fetchurl fetchFromGitHub dockerTools;
   };
   nixForNixPlugins = pkgs.nixVersions.nix_2_17;
-  buildCachedFirefox = useSccache: unwrapped:
-    (unwrapped.override {
-      buildMozillaMach = x: pkgs'.buildMozillaMach (x // {
-        extraConfigureFlags = (x.extraConfigureFlags or [])
-          ++ lib.toList (if useSccache then "--with-ccache=sccache" else "--with-ccache");
-      });
-    }).overrideAttrs (prev: if useSccache then {
-      nativeBuildInputs = (prev.nativeBuildInputs or []) ++ [ pkgs'.sccache ];
-      SCCACHE_DIR = "/var/cache/sccache";
-      SCCACHE_MAX_FRAME_LENGTH = "104857600";
-      RUSTC_WRAPPER = "${pkgs'.sccache}/bin/sccache";
-    } else {
-      nativeBuildInputs = (prev.nativeBuildInputs or []) ++ [ pkgs'.ccache ];
-      CCACHE_CPP2 = "yes";
-      CCACHE_COMPRESS = "1";
-      CCACHE_UMASK = "007";
-      CCACHE_DIR = "/var/cache/ccache";
-    });
 in
 
 {
@@ -80,11 +62,10 @@ in
 
   clang-tools_latest = pkgs.clang-tools_16;
   clang_latest = pkgs.clang_16;
-  buildFirefoxWithCcache = buildCachedFirefox false;
-  buildFirefoxWithSccache = buildCachedFirefox true;
   /*ghidra = pkgs.ghidra.overrideAttrs (old: {
     patches = old.patches ++ [ ./ghidra-stdcall.patch ];
   });*/
+  gimp = callPackage ./gimp { inherit (pkgs) gimp; };
   home-daemon = callPackage ./home-daemon { };
   # pin version
   looking-glass-client = pkgs.looking-glass-client.overrideAttrs (old: {
@@ -121,7 +102,7 @@ in
   techmino = callPackage ./techmino { };
 
   firefox-addons = lib.recurseIntoAttrs (callPackage ./firefox-addons { inherit nur sources; });
-  mpvScripts = pkgs.mpvScripts // (callPackage ./mpv-scripts { });
+  mpvScripts = pkgs.mpvScripts // callPackage ./mpv-scripts { };
 
   qemu_7 = callPackage ./qemu_7.nix {
     stdenv = pkgs'.ccacheStdenv;
@@ -139,8 +120,15 @@ in
   # TODO: when https://gitlab.com/virtio-fs/virtiofsd/-/issues/96 is fixed remove this
   virtiofsd = callPackage ./qemu_virtiofsd.nix {
     qemu = pkgs'.qemu_7;
+  };
+
+  qemu_7_ccache = pkgs'.qemu_7.override {
+    stdenv = pkgs'.ccacheStdenv;
+  };
+  virtiofsd_ccache = pkgs'.virtiofsd.override {
+    qemu = pkgs'.qemu_7_ccache;
     stdenv = pkgs'.ccacheStdenv;
   };
-  gimp = callPackage ./gimp { inherit (pkgs) gimp; };
 }
-// (import ../system/hardware/bpi-r3/pkgs.nix { inherit pkgs pkgs' lib sources; })
+// import ./ccache.nix { inherit pkgs pkgs' lib sources; }
+// import ../system/hardware/bpi-r3/pkgs.nix { inherit pkgs pkgs' lib sources; }
diff --git a/system/hardware/bpi-r3/pkgs.nix b/system/hardware/bpi-r3/pkgs.nix
index 3bcd5fd..da53d1c 100644
--- a/system/hardware/bpi-r3/pkgs.nix
+++ b/system/hardware/bpi-r3/pkgs.nix
@@ -1,5 +1,4 @@
 { pkgs
-, pkgs'
 , lib
 , sources
 , ... }:
@@ -60,31 +59,6 @@ let
     url = "ftp://ftp.denx.de/pub/u-boot/u-boot-${ubootVersion}.tar.bz2";
     hash = "sha256-tqp9fnGPQFeNGrkU/A6AusDEz7neh2KiR9HWbR7+WTY=";
   };
-  # there are few direct hits with the linux kernel, so use CCACHE_NODIRECT
-  # (direct hits are file-based, non-direct are preprocessed file-based)
-  ccacheConfig = ''
-    export CCACHE_COMPRESS=1
-    export CCACHE_DIR="/var/cache/ccache"
-    export CCACHE_UMASK=007
-    export CCACHE_SLOPPINESS=include_file_mtime,time_macros
-    export CCACHE_NODIRECT=1
-    if [ ! -d "$CCACHE_DIR" ]; then
-      echo "====="
-      echo "Directory '$CCACHE_DIR' does not exist"
-      echo "Please create it with:"
-      echo "  sudo mkdir -m0770 '$CCACHE_DIR'"
-      echo "  sudo chown root:nixbld '$CCACHE_DIR'"
-      echo "====="
-      exit 1
-    fi
-    if [ ! -w "$CCACHE_DIR" ]; then
-      echo "====="
-      echo "Directory '$CCACHE_DIR' is not accessible for user $(whoami)"
-      echo "Please verify its access permissions"
-      echo "====="
-      exit 1
-    fi
-  '';
 
 in rec {
   ubootBpiR3Sd = pkgs.buildUBoot {
@@ -334,12 +308,5 @@ in rec {
       MMC_MTK = yes;
     };
   };
-  linux_bpiR3_ccache = linux_bpiR3.override {
-    stdenv = pkgs'.ccacheStdenv.override { extraConfig = ccacheConfig; };
-    buildPackages = pkgs'.buildPackages // {
-      stdenv = pkgs'.buildPackages.ccacheStdenv.override { extraConfig = ccacheConfig; };
-    };
-  };
   linuxPackages_bpiR3 = pkgs.linuxPackagesFor linux_bpiR3;
-  linuxPackages_bpiR3_ccache = pkgs.linuxPackagesFor linux_bpiR3_ccache;
 }
diff --git a/system/modules/ccache.nix b/system/modules/ccache.nix
index 735b5b5..092a7f6 100644
--- a/system/modules/ccache.nix
+++ b/system/modules/ccache.nix
@@ -1,16 +1,15 @@
-{ config, lib, ... }:
+{ config
+, lib
+, ... }:
+
 {
   nix.settings.extra-sandbox-paths = lib.mkIf config.programs.ccache.enable [
-    config.programs.ccache.cacheDir
-    "/var/cache/sccache"
-  ];
-  impermanence.directories = lib.mkIf config.programs.ccache.enable [
-    config.programs.ccache.cacheDir
+    (assert config.programs.ccache.cacheDir == "/var/cache/ccache"; config.programs.ccache.cacheDir)
     "/var/cache/sccache"
   ];
   nixpkgs.overlays = lib.mkIf (config.programs.ccache.enable && config.programs.ccache.packageNames == []) [
     (self: super: {
-      ccacheWrapper = super.ccacheWrapper.override {
+      ccacheWrapper = if self?__dontIncludeCcacheOverlay then super.ccacheWrapper else super.ccacheWrapper.override {
         extraConfig = ''
           export CCACHE_COMPRESS=1
           export CCACHE_DIR="${config.programs.ccache.cacheDir}"
diff --git a/system/modules/impermanence.nix b/system/modules/impermanence.nix
index e755e25..8073738 100644
--- a/system/modules/impermanence.nix
+++ b/system/modules/impermanence.nix
@@ -127,6 +127,9 @@ in {
         { directory = /var/lib/openldap; inherit (config.services.openldap) user group; mode = "0755"; }
       ] ++ lib.optionals (config.services.scanservjs.enable or false) [
         { directory = /var/lib/scanservjs; user = "scanservjs"; group = "scanservjs"; mode = "0750"; }
+      ] ++ lib.optionals config.programs.ccache.enable [
+        { directory = config.programs.ccache.cacheDir; user = "root"; group = "nixbld"; mode = "0770"; }
+        { directory = /var/cache/sccache; user = "root"; group = "nixbld"; mode = "0770"; }
       ] ++ cfg.directories);
       files = map (x:
         if builtins.isPath x then toString x
diff --git a/system/modules/vfio.nix b/system/modules/vfio.nix
index f95b011..dea5e1f 100644
--- a/system/modules/vfio.nix
+++ b/system/modules/vfio.nix
@@ -192,6 +192,6 @@ in {
     };
     virtualisation.spiceUSBRedirection.enable = true;
     users.groups.libvirtd.members = [ "root" ] ++ cfg.libvirtdGroup;
-    environment.systemPackages = with pkgs; [ virtiofsd ];
+    environment.systemPackages = [ (pkgs.virtiofsd_ccache or pkgs.virtiofsd) ];
   };
 }