diff --git a/containers/jug/dev.Dockerfile b/containers/jug/dev.Dockerfile
index dfa5e58e3f60ee9a7a83452ea385b711554fc2cb..48ce4e6da3a919641572229399cea1e147ba8032 100644
--- a/containers/jug/dev.Dockerfile
+++ b/containers/jug/dev.Dockerfile
@@ -70,14 +70,6 @@ spack compiler find --scope site
 spack config blame compilers
 EOF
 
-## Setup local buildcache mirrors
-RUN --mount=type=cache,target=/var/cache/spack <<EOF
-set -e
-spack mirror add local /var/cache/spack/mirror/${SPACK_VERSION}
-spack buildcache update-index local
-spack mirror list
-EOF
-
 ## Setup eics3 buildcache mirrors
 ## - this always adds the read-only mirror to the container
 ## - the write-enabled mirror is provided later as a secret mount
@@ -144,13 +136,13 @@ RUN --mount=type=cache,target=/ccache,id=${TARGETPLATFORM}              \
     <<EOF
 set -e
 export CCACHE_DIR=/ccache
-spack buildcache update-index local
+find /var/cache/spack/blobs/sha256/ -atime +7 -delete
 spack buildcache update-index eics3rw
 spack env activate --dir ${SPACK_ENV}
 spack add juggler@git.${JUGGLER_VERSION}
 spack add eicrecon@git.${EICRECON_VERSION}
 spack concretize --fresh --force --quiet
-make --jobs ${jobs} --keep-going --directory /opt/spack-environment SPACK_ENV=${SPACK_ENV} BUILDCACHE_MIRROR="local eics3rw"
+make --jobs ${jobs} --keep-going --directory /opt/spack-environment SPACK_ENV=${SPACK_ENV} BUILDCACHE_MIRROR_ONLY_PACKAGE="eics3rw" BUILDCACHE_MIRROR_DEPENDENCIES="eicweb ghcr"
 ccache --show-stats
 ccache --zero-stats
 EOF
diff --git a/mirrors.yaml.in b/mirrors.yaml.in
index 369db4061d0482e90f278154475fae1aad1de219..d8999187b1be6c498d9550a6ad746259c0e4ae80 100644
--- a/mirrors.yaml.in
+++ b/mirrors.yaml.in
@@ -1,4 +1,16 @@
 mirrors:
+  eicweb:
+    url: oci://${CI_REGISTRY}/${CI_PROJECT_PATH}/spack-${SPACK_VERSION}
+    push:
+      access_pair:
+      - ${CI_REGISTRY_USER}
+      - ${CI_REGISTRY_PASSWORD}
+  ghcr:
+    url: oci://ghcr.io/eic/spack-${SPACK_VERSION}
+    push:
+      access_pair:
+      - ${GITHUB_REGISTRY_USER}
+      - ${GITHUB_REGISTRY_TOKEN}
   eics3rw:
     fetch:
       url: s3://eictest/EPIC/spack/${SPACK_VERSION}
diff --git a/spack-environment/Makefile b/spack-environment/Makefile
index 42f6fb6952ab835b887ff1ac3277679df8e14927..4492e0a9f4c03d8dc6aefc97a8aea934b6dc4cc0 100644
--- a/spack-environment/Makefile
+++ b/spack-environment/Makefile
@@ -7,7 +7,9 @@ export SPACK_COLOR = always
 
 SPACK_ENV ?= dev
 
-BUILDCACHE_MIRROR :=
+BUILDCACHE_MIRROR_ONLY_PACKAGE :=
+BUILDCACHE_MIRROR_DEPENDENCIES :=
+BUILDCACHE_OCI_BASE_IMAGE := ghcr.io/eic/debian:stable-slim
 
 .PHONY: all clean
 
@@ -18,11 +20,13 @@ include $(SPACK_ENV)/spack.mk
 endif
 
 $(SPACK_ENV)/push: $(addprefix $(SPACK_ENV)/push/,$($(SPACK_ENV)/SPACK_PACKAGE_IDS))
-	$(foreach buildcache, $(BUILDCACHE_MIRROR), $(SPACK) buildcache update-index $(buildcache) ;)
+	$(foreach buildcache, $(BUILDCACHE_MIRROR_ONLY_PACKAGE), $(SPACK) buildcache update-index $(buildcache) ;)
+	$(foreach buildcache, $(BUILDCACHE_MIRROR_DEPENDENCIES), $(SPACK) buildcache update-index $(buildcache) ;)
 
 $(SPACK_ENV)/push/%: $(SPACK_ENV)/install/%
 	@mkdir -p $(dir $@)
-	$(foreach buildcache, $(BUILDCACHE_MIRROR), $(SPACK) buildcache push --only=package --unsigned $(buildcache) /$(HASH) ;) # push $(SPEC)
+	$(foreach buildcache, $(BUILDCACHE_MIRROR_ONLY_PACKAGE), $(SPACK) buildcache push --only=package --unsigned $(buildcache) /$(HASH) ;) # push $(SPEC)
+	$(foreach buildcache, $(BUILDCACHE_MIRROR_DEPENDENCIES), $(SPACK) buildcache push --unsigned --base-image $(BUILDCACHE_OCI_BASE_IMAGE) $(buildcache) /$(HASH) | grep -v "Using cached archive" ;) # push $(SPEC)
 	@touch $@
 
 $(SPACK_ENV)/spack.lock: $(SPACK_ENV)/spack.yaml Makefile