diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b2d0330fd..ca7c24f36 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -233,7 +233,7 @@ demo docker:
     - xzcat uniworx:exe:uniworx.nar.xz | nix-store --import
     - xzcat uniworx:exe:uniworxdb.nar.xz | nix-store --import
     - nix -L build -o result .#uniworxDemoDocker
-    - nix-store --export $(nix-store -qR result) > uniworx-demo.nar # image is already compressed, no need for xz
+    - nix-store --export $(nix-store -qR result) | xz -T0 -2 > uniworx-demo.nar.xz # image is already compressed, closure isn't, therefore xz
   before_script: *nix-before
   needs:
     - job: node dependencies # transitive
@@ -252,7 +252,7 @@ demo docker:
       artifacts: false
   artifacts:
     paths:
-      - uniworx-demo.nar
+      - uniworx-demo.nar.xz
     name: "${CI_JOB_NAME}-${CI_COMMIT_SHORT_SHA}"
     expire_in: "1 day"
   retry: 2
@@ -263,7 +263,7 @@ docker:
   script:
     - xzcat uniworx:exe:uniworx.nar.xz | nix-store --import
     - nix -L build -o result .#uniworxDocker
-    - nix-store --export $(nix-store -qR result) > uniworx.nar # image is already compressed, no need for xz
+    - nix-store --export $(nix-store -qR result) | xz -T0 -2 > uniworx.nar.xz # image is already compressed, closure isn't, therefore xz
   before_script: *nix-before
   needs:
     - job: node dependencies # transitive
@@ -280,7 +280,7 @@ docker:
       artifacts: false
   artifacts:
     paths:
-      - uniworx.nar
+      - uniworx.nar.xz
     name: "${CI_JOB_NAME}-${CI_COMMIT_SHORT_SHA}"
     expire_in: "1 day"
   retry: 2
@@ -311,7 +311,7 @@ parse changelog:
 upload docker:
   stage: upload
   script:
-    - nix-store --import < uniworx.nar
+    - xzcat uniworx.nar.xz | nix-store --import
     - nix -L run .#pushUniworxDocker
   before_script: *nix-before
   needs:
@@ -336,7 +336,7 @@ upload docker:
 upload demo docker:
   stage: upload
   script:
-    - nix-store --import < uniworx-demo.nar
+    - xzcat uniworx-demo.nar.xz | nix-store --import
     - nix -L run .#pushUniworxDemoDocker
   before_script: *nix-before
   needs: