diff --git a/.github/workflows/build-machines-and-homes.yml b/.github/workflows/build-machines-and-homes.yml
index 7731122..1900b0e 100644
--- a/.github/workflows/build-machines-and-homes.yml
+++ b/.github/workflows/build-machines-and-homes.yml
@@ -7,7 +7,7 @@ env:
   ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
   NIX_CONFIG: |
     show-trace = true
-    extra-substituters = https://cache.cy7.sh/main
+    extra-substituters = https://cdn.cy7.sh/main
     extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
     experimental-features = nix-command flakes
     accept-flake-config = true
diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml
index fb0620e..1d23fe9 100644
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@@ -10,7 +10,7 @@ env:
   ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
   NIX_CONFIG: |
     show-trace = true
-    extra-substituters = https://cache.cy7.sh/main
+    extra-substituters = https://cdn.cy7.sh/main
     extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
     experimental-features = nix-command flakes
     accept-flake-config = true
diff --git a/flake.nix b/flake.nix
index 8370a2d..b469e18 100644
--- a/flake.nix
+++ b/flake.nix
@@ -107,7 +107,7 @@
   nixConfig = {
     extra-substituters = [
       "https://nix-community.cachix.org"
-      "https://cache.cy7.sh/main"
+      "https://cdn.cy7.sh/main"
     ];
     extra-trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
diff --git a/hosts/chunk/rclone.nix b/hosts/chunk/rclone.nix
index 60d4e0e..09f5b18 100644
--- a/hosts/chunk/rclone.nix
+++ b/hosts/chunk/rclone.nix
@@ -44,15 +44,17 @@
           --config ${config.sops.secrets."rclone/config".path} \
           --allow-other \
           --cache-dir /var/cache/rclone \
-          --transfers=32 \
+          --transfers 32 \
           --vfs-cache-mode full \
           --vfs-cache-min-free-space 5G \
           --dir-cache-time 30d \
           --no-checksum \
           --no-modtime \
           --vfs-fast-fingerprint \
-          --vfs-read-chunk-size 10M \
-          --vfs-read-chunk-streams 32 \
+          --vfs-read-chunk-size 4M \
+          --vfs-read-chunk-streams 64 \
+          --sftp-concurrency 128 \
+          --sftp-chunk-size 255k \
           rsyncnet:garage /mnt/garage
       '';
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
diff --git a/hosts/common.nix b/hosts/common.nix
index 779a4e1..7067008 100644
--- a/hosts/common.nix
+++ b/hosts/common.nix
@@ -15,7 +15,7 @@
       ];
       extra-substituters = [
         "https://nix-community.cachix.org"
-        "https://cache.cy7.sh/main"
+        "https://cdn.cy7.sh/main"
       ];
     };
     channel.enable = false;
diff --git a/modules/attic.nix b/modules/attic.nix
index 5aa54c6..c08afe1 100644
--- a/modules/attic.nix
+++ b/modules/attic.nix
@@ -18,7 +18,7 @@ in
       settings = {
         listen = "[::]:8091";
         api-endpoint = "https://cache.cy7.sh/";
-        allowed-hosts = [ "cache.cy7.sh" ];
+        allowed-hosts = [ "cache.cy7.sh" "cdn.cy7.sh" ];
         require-proof-of-possession = false;
         compression = {
           type = "none";
@@ -39,9 +39,12 @@ in
       };
     };
 
-    services.caddy.virtualHosts."cache.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy localhost:8091
-    '';
+    services.caddy.virtualHosts."cache.cy7.sh" = {
+      serverAliases = [ "cdn.cy7.sh" ];
+      extraConfig = ''
+        import common
+        reverse_proxy localhost:8091
+      '';
+    };
   };
 }