diff --git a/default.nix b/default.nix
index 2f707b6..ddbeb9b 100644
--- a/default.nix
+++ b/default.nix
@@ -167,6 +167,9 @@ let
 
           configurePhase = attrs.configurePhase or "export HOME=$(mktemp -d)";
 
+          nativeBuildInputs = (mkDerivationAttrs.nativeBuildInputs or [])
+                           ++ pkgs.lib.singleton pkgs.ip2unix;
+
           buildPhase = attrs.buildPhase or ''
             runHook preBuild
 
@@ -175,15 +178,16 @@ let
 
             echo "Starting napalm registry"
 
-            napalm-registry --snapshot ${snapshot} &
+            registrySock="$TMPDIR/registry.sock"
+            napalm-registry --path "$registrySock" --snapshot ${snapshot} &
             napalm_REGISTRY_PID=$!
 
-            while ! nc -z localhost 8081; do
-              echo waiting for registry to be alive on port 8081
+            while [ ! -e "$registrySock" ]; do
+              echo waiting for registry socket to be alive in "$registrySock"
               sleep 1
             done
 
-            npm config set registry 'http://localhost:8081'
+            npm config set registry 'http://127.0.0.100'
 
             export CPATH="${pkgs.nodejs}/include/node:$CPATH"
 
@@ -195,7 +199,8 @@ let
               while IFS= read -r c
               do
                 echo "Running npm command: $c"
-                $c || (echo "$c: failure, aborting" && kill $napalm_REGISTRY_PID && exit 1)
+                ip2unix -r out,addr=127.0.0.100,path="$registrySock" -- $c \
+                  || (echo "$c: failure, aborting" && kill $napalm_REGISTRY_PID && exit 1)
                 echo "Overzealously patching shebangs"
                 if [ -d node_modules ]; then find node_modules -type d -name bin | \
                   while read file; do patchShebangs $file; done; fi
diff --git a/napalm-registry/Main.hs b/napalm-registry/Main.hs
index 7af5ee0..18de9f0 100644
--- a/napalm-registry/Main.hs
+++ b/napalm-registry/Main.hs
@@ -31,6 +31,7 @@ import qualified Data.HashMap.Strict as HMS
 import qualified Data.Text as T
 import qualified Data.Text.IO as T
 import qualified Data.Text.Encoding as T
+import qualified Network.Socket as Socket
 import qualified Network.URI.Encode as URI
 import qualified Network.Wai.Handler.Warp as Warp
 import qualified Servant as Servant
@@ -38,8 +39,8 @@ import qualified Servant as Servant
 -- | See 'parseConfig' for field descriptions
 data Config = Config
   { configVerbose :: Bool
-  , configEndpoint :: T.Text
-  , configPort :: Int
+  , configHost :: T.Text
+  , configSocketPath :: FilePath
   , configSnapshot :: FilePath
   }
 
@@ -50,7 +51,13 @@ main = do
     snapshot <- Aeson.decodeFileStrict (configSnapshot config) >>= \case
       Just snapshot -> pure snapshot
       Nothing -> error $ "Could not parse packages"
-    Warp.run (configPort config) (Servant.serve api (server config snapshot))
+
+    socket <- Socket.socket Socket.AF_UNIX Socket.Stream 0
+    Socket.bind socket . Socket.SockAddrUnix $ configSocketPath config
+    Socket.listen socket Socket.maxListenQueue
+
+    Warp.runSettingsSocket Warp.defaultSettings socket $
+      Servant.serve api (server config snapshot)
 
 parseConfig :: Opts.Parser Config
 parseConfig = Config <$>
@@ -61,13 +68,13 @@ parseConfig = Config <$>
     ) <*>
     Opts.strOption (
       Opts.long "endpoint" <>
-      Opts.value "localhost" <>
-      Opts.help "The endpoint of this server, used in the Tarball URL"
+      Opts.value "127.0.0.100" <>
+      Opts.help "The fake endpoint of this server, used in the Tarball URL"
     ) <*>
-    Opts.option Opts.auto (
-      Opts.long "port" <>
-      Opts.value 8081 <>
-      Opts.help "The to serve on, also used in the Tarball URL"
+    Opts.strOption (
+      Opts.long "path" <>
+      Opts.value "registry.sock" <>
+      Opts.help "The Unix socket path to serve on"
     ) <*>
     Opts.strOption (
       Opts.long "snapshot" <>
@@ -251,9 +258,7 @@ mkTarballURL
   (URI.encodeText . unTarballName -> tarName)
   = "http://" <>
     T.intercalate "/"
-      [ configEndpoint config <> ":" <> tshow (configPort config), pn, "-", tarName ]
-  where
-    tshow = T.pack . show
+      [ configHost config, pn, "-", tarName ]
 
 readPackageJson :: FilePath -> IO Aeson.Object
 readPackageJson fp = do
diff --git a/napalm-registry/package.yaml b/napalm-registry/package.yaml
index 9cf87e4..b8f6c27 100644
--- a/napalm-registry/package.yaml
+++ b/napalm-registry/package.yaml
@@ -16,6 +16,7 @@ dependencies:
     - time
     - unordered-containers
     - uri-encode
+    - network
     - warp
     - zlib