diff --git a/ansible/files/nginx.service.j2 b/ansible/files/nginx.service.j2
deleted file mode 100644
index a43c3df609..0000000000
--- a/ansible/files/nginx.service.j2
+++ /dev/null
@@ -1,25 +0,0 @@
-[Unit]
-Description=nginx server
-After=postgrest.service gotrue.service adminapi.service
-Wants=postgrest.service gotrue.service adminapi.service
-
-StartLimitIntervalSec=0
-StartLimitBurst=0
-
-[Service]
-Type=forking
-ExecStart=/usr/local/nginx/sbin/nginx -c /etc/nginx/nginx.conf
-ExecReload=/usr/local/nginx/sbin/nginx -s reload -c /etc/nginx/nginx.conf
-ExecStop=/usr/local/nginx/sbin/nginx -s quit
-User=nginx
-Slice=services.slice
-Restart=always
-RestartSec=3
-LimitNOFILE=100000
-
-# Via systemd we grant the process a set of privileges to bind to 80/443
-# See http://archive.vn/36zJU
-AmbientCapabilities=CAP_NET_BIND_SERVICE
-
-[Install]
-WantedBy=multi-user.target
diff --git a/ansible/files/permission_check.py b/ansible/files/permission_check.py
index 5e17ebaa24..c286bd388f 100644
--- a/ansible/files/permission_check.py
+++ b/ansible/files/permission_check.py
@@ -69,7 +69,6 @@
     "gotrue": [{"groupname": "gotrue", "username": "gotrue"}],
     "envoy": [{"groupname": "envoy", "username": "envoy"}],
     "kong": [{"groupname": "kong", "username": "kong"}],
-    "nginx": [{"groupname": "nginx", "username": "nginx"}],
     "vector": [
         {"groupname": "adm", "username": "vector"},
         {"groupname": "postgres", "username": "vector"},
@@ -376,7 +375,6 @@ def main():
         "gotrue",
         "envoy",
         "kong",
-        "nginx",
         "vector",
         "adminapi",
         "postgrest",
diff --git a/ansible/playbook.yml b/ansible/playbook.yml
index 1a2543244a..613c4a99da 100644
--- a/ansible/playbook.yml
+++ b/ansible/playbook.yml
@@ -78,12 +78,6 @@
       tags:
         - install-supabase-internal
 
-    - name: Install nginx
-      when: not stage2
-      import_tasks: tasks/setup-nginx.yml
-      tags:
-        - install-supabase-internal
-
     - name: Install Supabase specific content
       when: not stage2
       import_tasks: tasks/setup-supabase-internal.yml
@@ -167,9 +161,6 @@
         update_cache: yes
         cache_valid_time: 3600
 
-    - name: Clean out build dependencies
-      import_tasks: tasks/clean-build-dependencies.yml
-
     - name: Run migrations
       when: stage2
       import_tasks: tasks/setup-migrations.yml
diff --git a/ansible/tasks/clean-build-dependencies.yml b/ansible/tasks/clean-build-dependencies.yml
deleted file mode 100644
index 567398f5fb..0000000000
--- a/ansible/tasks/clean-build-dependencies.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-- name: Remove build dependencies
-  ansible.builtin.apt:
-    autoremove: true
-    pkg:
-      - bison
-      - build-essential
-      - clang-11
-      - cmake
-      - cpp
-      - flex
-      - g++
-      - g++-10
-      - g++-9
-      - gcc-10
-      - make
-      - manpages
-      - manpages-dev
-      - ninja-build
-      - patch
-      - python2
-    state: 'absent'
diff --git a/ansible/tasks/internal/supautils.yml b/ansible/tasks/internal/supautils.yml
deleted file mode 100644
index 0e0d7de284..0000000000
--- a/ansible/tasks/internal/supautils.yml
+++ /dev/null
@@ -1,81 +0,0 @@
-# supautils
-- name: supautils - download & install dependencies
-  apt:
-    pkg:
-      - build-essential
-      - clang-11
-    update_cache: yes
-    cache_valid_time: 3600
-
-- name: supautils - download latest release
-  get_url:
-    url: "https://github.com/supabase/supautils/archive/refs/tags/v{{ supautils_release }}.tar.gz"
-    checksum: "{{ supautils_release_checksum }}"
-    dest: /tmp/supautils-{{ supautils_release }}.tar.gz
-    timeout: 60
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: supautils - unpack archive
-  unarchive:
-    remote_src: yes
-    src: /tmp/supautils-{{ supautils_release }}.tar.gz
-    dest: /tmp
-  become: yes
-
-- name: supautils - build
-  make:
-    chdir: /tmp/supautils-{{ supautils_release }}
-  become: yes
-
-- name: supautils - install
-  make:
-    chdir: /tmp/supautils-{{ supautils_release }}
-    target: install
-  become: yes
-
-- name: supautils - add supautils to session_preload_libraries
-  become: yes
-  replace:
-    path: /etc/postgresql/postgresql.conf
-    regexp: "#session_preload_libraries = ''"
-    replace: session_preload_libraries = 'supautils'
-
-- name: supautils - write custom supautils.conf
-  template:
-    src: "files/postgresql_config/supautils.conf.j2"
-    dest: /etc/postgresql-custom/supautils.conf
-    mode: 0664
-    owner: postgres
-    group: postgres
-
-- name: supautils - copy extension custom scripts
-  copy:
-    src: files/postgresql_extension_custom_scripts/
-    dest: /etc/postgresql-custom/extension-custom-scripts
-  become: yes
-
-- name: supautils - chown extension custom scripts
-  file:
-    mode: 0775
-    owner: postgres
-    group: postgres
-    path: /etc/postgresql-custom/extension-custom-scripts
-    recurse: yes
-  become: yes
-
-- name: supautils - include /etc/postgresql-custom/supautils.conf in postgresql.conf
-  become: yes
-  replace:
-    path: /etc/postgresql/postgresql.conf
-    regexp: "#include = '/etc/postgresql-custom/supautils.conf'"
-    replace: "include = '/etc/postgresql-custom/supautils.conf'"
-
-- name: supautils - remove build dependencies
-  apt:
-    pkg:
-      - build-essential
-      - clang-11
-    state: absent
diff --git a/ansible/tasks/setup-nginx.yml b/ansible/tasks/setup-nginx.yml
deleted file mode 100644
index 5bf23dbdf4..0000000000
--- a/ansible/tasks/setup-nginx.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-- name: nginx - system user
-  ansible.builtin.user:
-    name: 'nginx'
-    state: 'present'
-
-# Kong installation steps from http://archive.vn/3HRQx
-- name: nginx - system dependencies
-  ansible.builtin.apt:
-    pkg:
-      - libpcre3-dev
-      - libssl-dev
-      - openssl
-      - zlib1g-dev
-
-- name: nginx - download source
-  ansible.builtin.get_url:
-    url: "{{ nginx_artifacts['url'] }}"
-    checksum: "{{ nginx_artifacts['checksum'] }}"
-    dest: '/tmp/nginx-{{ nginx_release }}.tar.gz'
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: nginx - unpack archive
-  ansible.builtin.unarchive:
-    dest: '/tmp'
-    remote_src: true
-    src: "/tmp/nginx-{{ nginx_release }}.tar.gz"
-
-- name: nginx - configure
-  ansible.builtin.command:
-    argv:
-      - ./configure 
-      - --prefix=/usr/local/nginx 
-      - --conf-path=/etc/nginx/nginx.conf 
-      - --with-http_ssl_module 
-      - --with-http_realip_module 
-      - --with-threads
-  args:
-    chdir: "/tmp/nginx-{{ nginx_release }}"
-  become: true
-
-- name: nginx - build and install
-  community.general.make:
-    chdir: "/tmp/nginx-{{ nginx_release }}"
-    jobs: "{{ parallel_jobs | default(omit) }}"
-    target: "{{ make_target }}"
-  become: true
-  loop:
-    - 'build'
-    - 'install'
-  loop_control:
-    loop_var: 'make_target'
-
-- name: nginx - hand over ownership of /etc/nginx and /usr/local/nginx to user nginx
-  ansible.builtin.file:
-    owner: 'nginx'
-    path: "{{ nginx_dir_item }}"
-    recurse: true
-  loop:
-    - /etc/nginx
-    - /usr/local/nginx
-  loop_control:
-    loop_var: 'nginx_dir_item'
-
-# [warn] ulimit is currently set to "1024". For better performance set it to at least
-# "4096" using "ulimit -n"
-- name: nginx - bump up ulimit
-  community.general.pam_limits:
-    domain: 'nginx'
-    limit_item: 'nofile'
-    limit_type: 'soft'
-    value: '4096'
-
-- name: nginx - create service file
-  ansible.builtin.template:
-    dest: '/etc/systemd/system/nginx.service'
-    src: 'files/nginx.service.j2'
-
-# Keep it dormant for the timebeing
-
-# - name: nginx - reload systemd
-#   systemd:
-#     daemon_reload: yes
diff --git a/ansible/tasks/setup-pgbouncer.yml b/ansible/tasks/setup-pgbouncer.yml
index 2a1b94d5c8..daeeb35d05 100644
--- a/ansible/tasks/setup-pgbouncer.yml
+++ b/ansible/tasks/setup-pgbouncer.yml
@@ -1,52 +1,4 @@
 # PgBouncer
-- name: PgBouncer - download & install dependencies
-  ansible.builtin.apt:
-    pkg:
-      - build-essential
-      - libevent-dev
-      - libssl-dev
-      - libsystemd-dev
-      - pkg-config
-      - pandoc
-      - python3
-    update_cache: true
-
-- name: PgBouncer - download latest release
-  ansible.builtin.get_url:
-    url: "{{ pgbouncer_artifacts['url'] }}"
-    checksum: "{{ pgbouncer_artifacts['checksum'] }}"
-    dest: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-    timeout: 60
-  register: download_result
-  until: download_result is succeeded
-  retries: 3
-  delay: 2
-
-- name: PgBouncer - unpack archive
-  ansible.builtin.unarchive:
-    dest: '/tmp'
-    remote_src: true
-    src: "/tmp/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-  become: true
-
-- name: PgBouncer - configure
-  ansible.builtin.command:
-    cmd: './configure --prefix=/usr/local --with-systemd'
-  args:
-    chdir: "/tmp/pgbouncer-{{ pgbouncer_release }}"
-  become: true
-
-- name: PgBouncer - build and install
-  community.general.make:
-    chdir: "/tmp/pgbouncer-{{ pgbouncer_release }}"
-    target: "{{ pgbouncer_make_item }}"
-  become: true
-  loop:
-    - 'all'
-    - 'install'
-  loop_control:
-    loop_var: 'pgbouncer_make_item'
-
 - name: Create pgbouncer user
   ansible.builtin.user:
     comment: 'PgBouncer user'
@@ -55,6 +7,21 @@
     shell: '/usr/sbin/nolign'
     state: 'present'
 
+- name: Install PgBouncer from nix binary cache
+  when: stage2
+  ansible.builtin.shell:
+    cmd: sudo -u pgbouncer bash -c ". /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh && nix profile install github:supabase/postgres/{{ git_commit_sha }}#pgbouncer"
+  become: true
+
+- name: Link PgBouncer into /usr/local/bin
+  when: stage2
+  ansible.builtin.file:
+    dest: '/usr/local/bin/pgbouncer'
+    force: true
+    src: '/home/pgbouncer/.nix-profile/bin/pgbouncer'
+    state: 'link'
+  become: true
+
 - name: Create PgBouncer directories if they do not exist
   ansible.builtin.file:
     group: 'pgbouncer'
diff --git a/ansible/vars.yml b/ansible/vars.yml
index 930129c95e..fd7b13364c 100644
--- a/ansible/vars.yml
+++ b/ansible/vars.yml
@@ -118,14 +118,6 @@ gotrue_artifacts:
   arm64:
     url: "https://github.com/supabase/gotrue/releases/download/v{{ gotrue_release }}/auth-v{{ gotrue_release }}-arm64.tar.gz"
     checksum: sha256:547b80c455f2bbf01a624d0e3bc98c31237ca479d4aa0d236d40678370e34a69
-nginx_release: 1.22.0
-nginx_artifacts:
-  url: "https://nginx.org/download/nginx-{{ nginx_release }}.tar.gz"
-  checksum: sha256:b33d569a6f11a01433a57ce17e83935e953ad4dc77cdd4d40f896c88ac26eb53
-pgbouncer_release: 1.25.1
-pgbouncer_artifacts:
-  url: "https://www.pgbouncer.org/downloads/files/{{ pgbouncer_release }}/pgbouncer-{{ pgbouncer_release }}.tar.gz"
-  checksum: sha256:6e566ae92fe3ef7f6a1b9e26d6049f7d7ca39c40e29e7b38f6d5500ae15d8465
 postgrest_release: "14.17" # keep this as an *explicit* string, otherwise gets treated as yaml float which will likely only lead to tears
 postgrest_artifacts:
   amd64:
diff --git a/audit-specs/baselines/ami-build/group.yml b/audit-specs/baselines/ami-build/group.yml
index 7622810841..f10c44f7ca 100644
--- a/audit-specs/baselines/ami-build/group.yml
+++ b/audit-specs/baselines/ami-build/group.yml
@@ -39,8 +39,6 @@ group:
     exists: true
   envoy:
     exists: true
-  nginx:
-    exists: true
   vector:
     exists: true
   supabase-admin-agent:
diff --git a/audit-specs/baselines/ami-build/user.yml b/audit-specs/baselines/ami-build/user.yml
index e764be6268..3210e47f4a 100644
--- a/audit-specs/baselines/ami-build/user.yml
+++ b/audit-specs/baselines/ami-build/user.yml
@@ -43,9 +43,6 @@ user:
   envoy:
     exists: true
     home: /home/envoy
-  nginx:
-    exists: true
-    home: /home/nginx
   vector:
     exists: true
     home: /var/lib/vector
diff --git a/audit-specs/baselines/baseline.yml b/audit-specs/baselines/baseline.yml
index 395366c1da..5f3979a2ce 100644
--- a/audit-specs/baselines/baseline.yml
+++ b/audit-specs/baselines/baseline.yml
@@ -4471,96 +4471,6 @@ file:
     owner: "1006"
     group: "0"
     filetype: file
-  /etc/nginx/fastcgi.conf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/fastcgi.conf.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/fastcgi_params:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/fastcgi_params.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/koi-utf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/koi-win:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/mime.types:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/mime.types.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/nginx.conf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/nginx.conf.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/scgi_params:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/scgi_params.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/uwsgi_params:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/uwsgi_params.default:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /etc/nginx/win-utf:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
   /etc/nix/nix.conf:
     exists: true
     mode: "0644"
@@ -5509,12 +5419,6 @@ file:
     owner: "0"
     group: "0"
     filetype: file
-  /etc/systemd/system/nginx.service:
-    exists: true
-    mode: "0644"
-    owner: "0"
-    group: "0"
-    filetype: file
   /etc/systemd/system/pg_egress_collect.service:
     exists: true
     mode: "0644"
@@ -5971,24 +5875,6 @@ file:
     owner: "1004"
     group: "1008"
     filetype: file
-  /home/nginx/.bash_logout:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "1009"
-    filetype: file
-  /home/nginx/.bashrc:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "1009"
-    filetype: file
-  /home/nginx/.profile:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "1009"
-    filetype: file
   /home/pgbouncer/.bash_logout:
     exists: true
     mode: "0644"
@@ -62029,24 +61915,6 @@ file:
     owner: "0"
     group: "0"
     filetype: directory
-  /usr/local/nginx/html/50x.html:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /usr/local/nginx/html/index.html:
-    exists: true
-    mode: "0644"
-    owner: "1005"
-    group: "0"
-    filetype: file
-  /usr/local/nginx/sbin/nginx:
-    exists: true
-    mode: "0755"
-    owner: "1005"
-    group: "0"
-    filetype: file
   /usr/local/openresty/COPYRIGHT:
     exists: true
     mode: "0664"
@@ -91043,9 +90911,6 @@ group:
   news:
     exists: true
     gid: 9
-  nginx:
-    exists: true
-    gid: 1009
   nixbld:
     exists: true
     gid: 30000
@@ -95914,12 +95779,6 @@ user:
     gid: 9
     home: /var/spool/news
     shell: /usr/sbin/nologin
-  nginx:
-    exists: true
-    uid: 1005
-    gid: 1009
-    home: /home/nginx
-    shell: /bin/sh
   nixbld1:
     exists: true
     uid: 30001
diff --git a/audit-specs/baselines/prod-deployed/files-etc-deployed.yml b/audit-specs/baselines/prod-deployed/files-etc-deployed.yml
index 4d44861f31..66fd6c1002 100644
--- a/audit-specs/baselines/prod-deployed/files-etc-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-etc-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: etc
-# Generated from baseline.yml - 735 files
+# Generated from baseline.yml - 720 files
 file:
   /etc/.pwd.lock:
     exists: true
@@ -3385,96 +3385,6 @@ file:
     group: '0'
     mode: '0644'
     owner: '0'
-  /etc/nginx/fastcgi.conf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/fastcgi.conf.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/fastcgi_params:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/fastcgi_params.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/koi-utf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/koi-win:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/mime.types:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/mime.types.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/nginx.conf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/nginx.conf.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/scgi_params:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/scgi_params.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/uwsgi_params:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/uwsgi_params.default:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /etc/nginx/win-utf:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
   /etc/nix/nix.conf:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/files-home-deployed.yml b/audit-specs/baselines/prod-deployed/files-home-deployed.yml
index af3d0e6764..a9c67dcf6d 100644
--- a/audit-specs/baselines/prod-deployed/files-home-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-home-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: home
-# Generated from baseline.yml - 38 files
+# Generated from baseline.yml - 35 files
 file:
   /home/adminapi/.bash_logout:
     exists: true
@@ -79,24 +79,6 @@ file:
     group: '1008'
     mode: '0644'
     owner: '1004'
-  /home/nginx/.bash_logout:
-    exists: true
-    filetype: file
-    group: '1009'
-    mode: '0644'
-    owner: '1005'
-  /home/nginx/.bashrc:
-    exists: true
-    filetype: file
-    group: '1009'
-    mode: '0644'
-    owner: '1005'
-  /home/nginx/.profile:
-    exists: true
-    filetype: file
-    group: '1009'
-    mode: '0644'
-    owner: '1005'
   /home/pgbouncer/.bash_logout:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml b/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml
index a01cc5f045..011a3f931c 100644
--- a/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-systemd-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: systemd
-# Generated from baseline.yml - 34 files
+# Generated from baseline.yml - 33 files
 file:
   /etc/systemd/journald.conf:
     exists: true
@@ -97,12 +97,6 @@ file:
     group: '0'
     mode: '0644'
     owner: '0'
-  /etc/systemd/system/nginx.service:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '0'
   /etc/systemd/system/pg_egress_collect.service:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml b/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml
index 7ea65bc700..f7f8ae3e27 100644
--- a/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/files-usr-local-deployed.yml
@@ -1,5 +1,5 @@
 # File baseline: usr-local
-# Generated from baseline.yml - 7956 files
+# Generated from baseline.yml - 7953 files
 file:
   /usr/local/aws-cli/v2/2.23.11/dist/_awscrt.abi3.so:
     exists: true
@@ -45817,24 +45817,6 @@ file:
     group: '0'
     mode: '0755'
     owner: '0'
-  /usr/local/nginx/html/50x.html:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /usr/local/nginx/html/index.html:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0644'
-    owner: '1005'
-  /usr/local/nginx/sbin/nginx:
-    exists: true
-    filetype: file
-    group: '0'
-    mode: '0755'
-    owner: '1005'
   /usr/local/openresty/COPYRIGHT:
     exists: true
     filetype: file
diff --git a/audit-specs/baselines/prod-deployed/group-deployed.yml b/audit-specs/baselines/prod-deployed/group-deployed.yml
index 6ad5a910e3..d9d2cae2b6 100644
--- a/audit-specs/baselines/prod-deployed/group-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/group-deployed.yml
@@ -1,5 +1,5 @@
 # Group baseline
-# Generated from baseline.yml - 70 items
+# Generated from baseline.yml - 69 items
 group:
   _ssh:
     exists: true
@@ -94,9 +94,6 @@ group:
   news:
     exists: true
     gid: 9
-  nginx:
-    exists: true
-    gid: 1009
   nixbld:
     exists: true
     gid: 30000
diff --git a/audit-specs/baselines/prod-deployed/user-deployed.yml b/audit-specs/baselines/prod-deployed/user-deployed.yml
index 9ae9fffec8..183aa23c42 100644
--- a/audit-specs/baselines/prod-deployed/user-deployed.yml
+++ b/audit-specs/baselines/prod-deployed/user-deployed.yml
@@ -1,5 +1,5 @@
 # User baseline
-# Generated from baseline.yml - 72 items
+# Generated from baseline.yml - 71 items
 user:
   _apt:
     exists: true
@@ -109,12 +109,6 @@ user:
     home: /var/spool/news
     shell: /usr/sbin/nologin
     uid: 9
-  nginx:
-    exists: true
-    gid: 1009
-    home: /home/nginx
-    shell: /bin/sh
-    uid: 1005
   nixbld1:
     exists: true
     gid: 30000
diff --git a/ebssurrogate/scripts/chroot-bootstrap-nix.sh b/ebssurrogate/scripts/chroot-bootstrap-nix.sh
index f1f94551c1..140f6802dd 100755
--- a/ebssurrogate/scripts/chroot-bootstrap-nix.sh
+++ b/ebssurrogate/scripts/chroot-bootstrap-nix.sh
@@ -194,6 +194,7 @@ function update_install_packages {
 	# because their post-install scripts try to access EC2 metadata service
 	# which doesn't work in a chroot and causes long hangs
 	if ! apt_install_with_fallback install -y \
+		bzip2 \
 		sudo \
 		wget \
 		cloud-init \