diff --git a/.gitignore b/.gitignore
index 8703795..8199d78 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 cosign.key
 cosign.private
 /Containerfile
+/.bluebuild-scripts_*
diff --git a/scripts/install-nix.sh b/files/scripts/install-nix.sh
similarity index 51%
rename from scripts/install-nix.sh
rename to files/scripts/install-nix.sh
index 39a0332..05e0457 100755
--- a/scripts/install-nix.sh
+++ b/files/scripts/install-nix.sh
@@ -5,9 +5,16 @@ rpm_url="https://nix-community.github.io/nix-installers/nix/x86_64/nix-multi-use
 
 install -d /usr/share/nix-store /var/lib/nix-store /var/cache/nix-store /nix
 
-dnf install -y "$rpm_url"
+# Avoid systemd calls during RPM %post in the image build environment.
+export SYSTEMD_OFFLINE=1
+
+# Install the RPM; allow missing GPG key since we fetch directly by URL.
+dnf install -y --nogpgcheck "$rpm_url"
 
 # Move the pre-populated store out of /nix so it can serve as the immutable lowerdir.
 if compgen -G "/nix/*" >/dev/null; then
   mv /nix/* /usr/share/nix-store/
 fi
+
+# The RPM %post handles sysusers/tmpfiles; if we ran with SYSTEMD_OFFLINE the
+# post scripts are still executed, so no extra calls are needed here.