diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2e825cf..9f01f4c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -53,6 +53,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -70,6 +71,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -94,6 +96,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -118,6 +121,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -142,6 +146,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -166,6 +171,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
@@ -190,6 +196,7 @@ jobs:
             PICORE_VERSION_MAJOR=${{ env.PICORE_VERSION_MAJOR }}
             PICORE_VERSION_MINOR=${{ env.PICORE_VERSION_MINOR }}
             PICORE_VERSION_MICRO=${{ env.PICORE_VERSION_MICRO }}
+            TCEMIRROR=${{ secrets.TCEMIRROR }}
           push: false
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/docker/Dockerfile b/docker/Dockerfile
index 1cdd9f7..6d51bff 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -73,27 +73,24 @@ ARG KERNEL=6.12.25-piCore-v8
 
 RUN rm /bin/uname && echo -e "#!/bin/sh\necho $KERNEL" > /bin/uname && chmod +x /bin/uname
 
-RUN for EXT in net-usb-KERNEL usb-serial-KERNEL usb-gadget-KERNEL wpa_supplicant wireless_tools wireless-KERNEL firmware-rpi-wifi iw hostapd iptables; \
+ARG TCEMIRROR
+RUN echo "$TCEMIRROR" > /opt/tcemirror
+
+ARG EXTENSIONS="net-usb-KERNEL usb-serial-KERNEL usb-gadget-KERNEL wpa_supplicant wireless_tools wireless-KERNEL \
+	firmware-rpi-wifi iw hostapd iptables tryboot busybox-system watchdog"
+
+RUN for EXT in $EXTENSIONS; \
         do \
                 su -l tc -c "tce-load -w $EXT" \
                 && echo "${EXT}.tcz" >> /etc/sysconfig/tcedir/onboot.lst ; \
         done
 
-# install external extensions
-RUN ( \
-        TCEMIRROR="$(cat /opt/tcemirror)"; \
-        for EXT in tryboot busybox-system watchdog; \
-        do \
-                echo "https://github.com/asssaf/picore-${EXT}/raw/refs/heads/tcz-v0.0.1" > /opt/tcemirror \
-                && su -l tc -c "tce-load -w $EXT" \
-                && echo "${EXT}.tcz" >> /etc/sysconfig/tcedir/onboot.lst ; \
-        done \
-        && echo "$TCEMIRROR" > /opt/tcemirror \
-)
-
 COPY --from=extensions /tcz/* /etc/sysconfig/tcedir/optional/
+ARG INTERNAL_EXTENSIONS="service-serial service-wifi service-dhcp service-dhcpd service-hostapd recovery \
+	service-gadget firewall service-watchdog"
+
 RUN ( \
-	for EXT in service-serial service-wifi service-dhcp service-dhcpd service-hostapd recovery service-gadget firewall service-watchdog; \
+	for EXT in $INTERNAL_EXTENSIONS; \
 	do \
 		echo "${EXT}.tcz" >> /etc/sysconfig/tcedir/onboot.lst ; \
 	done \
diff --git a/scripts/build.sh b/scripts/build.sh
index f50a29a..5d28ab4 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -9,6 +9,7 @@ set -eux
 : ${PLATFORM:=linux/arm64/v8}
 : ${TARGET:=install}
 : ${IMAGE:=asssaf/picore}
+: ${TCEMIRROR:=}
 
 #docker run --privileged --rm tonistiigi/binfmt --install arm64
 
@@ -17,5 +18,6 @@ docker build --platform=${PLATFORM} --target=${TARGET} \
     --build-arg PICORE_VERSION_MAJOR=${PICORE_VERSION_MAJOR} \
     --build-arg PICORE_VERSION_MINOR=${PICORE_VERSION_MINOR} \
     --build-arg PICORE_VERSION_MICRO=${PICORE_VERSION_MICRO} \
+    --build-arg TCEMIRROR=${TCEMIRROR} \
     -t ${IMAGE} \
     -f docker/Dockerfile "$@" .