diff --git a/README.md b/README.md
index 325cedd..a2ce1f5 100644
--- a/README.md
+++ b/README.md
@@ -26,6 +26,7 @@ Add or merge the following settings to your `flake.nix`:
 - `c3d2.addKnownHosts`: set to true to add the public ssh host keys to the known_hosts file.
 - `c3d2.audioStreaming`: set to true to enable all services to audio stream to pulsebert, dacbert or glotzbert in hq.
   After enabling this option run ``systemctl --user restart pulseaudio`` or ``systemctl --user restart pipewire-pulse``.
+- `c3d2.addBinaryCache`: set to true to add the [c3d2 hydra](https://hydra.hq.c3d2.de/) as permanent trusted-substituter.
 
 ## Design
 
diff --git a/modules/binary-cache.nix b/modules/binary-cache.nix
new file mode 100644
index 00000000..4366ba3
--- /dev/null
+++ b/modules/binary-cache.nix
@@ -0,0 +1,17 @@
+{ config, lib, libS, ... }:
+
+let
+  cfg = config.c3d2.addBinaryCache;
+in
+{
+  options = {
+    c3d2.addBinaryCache = libS.mkOpinionatedOption "add hydra.hq.c3d2.de as a trusted substituter";
+  };
+
+  config = lib.mkIf cfg {
+    nix.settings = {
+      trusted-public-keys = [ "nix-serve.hq.c3d2.de:KZRGGnwOYzys6pxgM8jlur36RmkJQ/y8y62e52fj1ps=" ];
+      trusted-substituters = [ "https://nix-serve.hq.c3d2.de" ];
+    };
+  };
+}