diff --git a/.golangci.yml b/.golangci.yml
index 9faefad13cd..3c49338ecc4 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -86,3 +86,6 @@ linters-settings:
   wrapcheck:
     ignorePackageGlobs:
       - go.jetpack.io/devbox/*
+  misspell:
+    ignore-words:
+      - substituters
diff --git a/internal/devbox/bincache/bincache.go b/internal/devbox/bincache/bincache.go
new file mode 100644
index 00000000000..7d08aec9a76
--- /dev/null
+++ b/internal/devbox/bincache/bincache.go
@@ -0,0 +1,25 @@
+package bincache
+
+import "os"
+
+// ExtraSubstituter returns the URI of the extra substituter to use.
+// a substituter is a bin cache URI that nix can use to fetch pre-built
+// binaries from.
+func ExtraSubstituter() (string, error) {
+	if err := ensureTrustedUser(); err != nil {
+		return "", err
+	}
+
+	// TODO: if user is logged in (or if we have token we can refresh)
+	// then we try to fetch the bincache URI from the API.
+
+	// DEVBOX_NIX_BINCACHE_URI seems like a friendlier name than "substituter"
+	return os.Getenv("DEVBOX_NIX_BINCACHE_URI"), nil
+}
+
+func ensureTrustedUser() error {
+	// TODO: we need to ensure that the user can actually use the extra
+	// substituter. If the user did a root install, then we need to add
+	// the extra substituter to the nix.conf file and restart the daemon.
+	return nil
+}
diff --git a/internal/devbox/packages.go b/internal/devbox/packages.go
index c1734d51c58..e1ef7d5984d 100644
--- a/internal/devbox/packages.go
+++ b/internal/devbox/packages.go
@@ -17,6 +17,7 @@ import (
 	"github.com/fatih/color"
 	"github.com/pkg/errors"
 	"github.com/samber/lo"
+	"go.jetpack.io/devbox/internal/devbox/bincache"
 	"go.jetpack.io/devbox/internal/devbox/devopt"
 	"go.jetpack.io/devbox/internal/devconfig"
 	"go.jetpack.io/devbox/internal/devpkg"
@@ -445,11 +446,17 @@ func (d *Devbox) installNixPackagesToStore(ctx context.Context, mode installMode
 			flags = append(flags, "--refresh")
 		}
 
+		extraSubstituter, err := bincache.ExtraSubstituter()
+		if err != nil {
+			return err
+		}
+
 		for _, installable := range installables {
 			args := &nix.BuildArgs{
-				AllowInsecure: pkg.HasAllowInsecure(),
-				Flags:         flags,
-				Writer:        d.stderr,
+				AllowInsecure:    pkg.HasAllowInsecure(),
+				Flags:            flags,
+				Writer:           d.stderr,
+				ExtraSubstituter: extraSubstituter,
 			}
 			err = nix.Build(ctx, args, installable)
 			if err != nil {
diff --git a/internal/nix/build.go b/internal/nix/build.go
index a60382c5e2a..d0684ec6319 100644
--- a/internal/nix/build.go
+++ b/internal/nix/build.go
@@ -12,9 +12,10 @@ import (
 )
 
 type BuildArgs struct {
-	AllowInsecure bool
-	Flags         []string
-	Writer        io.Writer
+	AllowInsecure    bool
+	ExtraSubstituter string
+	Flags            []string
+	Writer           io.Writer
 }
 
 func Build(ctx context.Context, args *BuildArgs, installables ...string) error {
@@ -22,6 +23,11 @@ func Build(ctx context.Context, args *BuildArgs, installables ...string) error {
 	cmd := commandContext(ctx, "build", "--impure")
 	cmd.Args = append(cmd.Args, args.Flags...)
 	cmd.Args = append(cmd.Args, installables...)
+	// Adding extra substituters only here to be conservative, but this could also
+	// be added to ExperimentalFlags() in the future.
+	if args.ExtraSubstituter != "" {
+		cmd.Args = append(cmd.Args, "--extra-substituters", args.ExtraSubstituter)
+	}
 	cmd.Env = allowUnfreeEnv(os.Environ())
 	if args.AllowInsecure {
 		debug.Log("Setting Allow-insecure env-var\n")