diff --git a/packages/kontinuous/tests/__snapshots__/job-builds.dev.yaml b/packages/kontinuous/tests/__snapshots__/job-builds.dev.yaml
index e7529fa65a..3372393f6e 100644
--- a/packages/kontinuous/tests/__snapshots__/job-builds.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/job-builds.dev.yaml
@@ -187,12 +187,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -367,12 +373,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/jobs-build-options.dev.yaml b/packages/kontinuous/tests/__snapshots__/jobs-build-options.dev.yaml
index 37cd0ea3a9..f9f9d7a35b 100644
--- a/packages/kontinuous/tests/__snapshots__/jobs-build-options.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/jobs-build-options.dev.yaml
@@ -188,12 +188,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/jobs-build-stage.dev.yaml b/packages/kontinuous/tests/__snapshots__/jobs-build-stage.dev.yaml
index 69d3b22433..cd7362387a 100644
--- a/packages/kontinuous/tests/__snapshots__/jobs-build-stage.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/jobs-build-stage.dev.yaml
@@ -484,12 +484,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -664,12 +670,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/jobs-build.dev.yaml b/packages/kontinuous/tests/__snapshots__/jobs-build.dev.yaml
index eb837ad47c..bec2b790e5 100644
--- a/packages/kontinuous/tests/__snapshots__/jobs-build.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/jobs-build.dev.yaml
@@ -483,12 +483,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -662,12 +668,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/repo.domifa.dev.yaml b/packages/kontinuous/tests/__snapshots__/repo.domifa.dev.yaml
index 3f77ba9584..0e07aa81a0 100644
--- a/packages/kontinuous/tests/__snapshots__/repo.domifa.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/repo.domifa.dev.yaml
@@ -224,12 +224,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -408,12 +414,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -593,12 +605,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -774,12 +792,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/repo.domifa.preprod.yaml b/packages/kontinuous/tests/__snapshots__/repo.domifa.preprod.yaml
index 9046cdc1cb..6e69ac017f 100644
--- a/packages/kontinuous/tests/__snapshots__/repo.domifa.preprod.yaml
+++ b/packages/kontinuous/tests/__snapshots__/repo.domifa.preprod.yaml
@@ -222,12 +222,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -402,12 +408,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -587,12 +599,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -768,12 +786,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/repo.domifa.prod.yaml b/packages/kontinuous/tests/__snapshots__/repo.domifa.prod.yaml
index 476c507f9c..5bb94e94d4 100644
--- a/packages/kontinuous/tests/__snapshots__/repo.domifa.prod.yaml
+++ b/packages/kontinuous/tests/__snapshots__/repo.domifa.prod.yaml
@@ -277,12 +277,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -460,12 +466,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -645,12 +657,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
@@ -827,12 +845,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops-override.dev.yaml b/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops-override.dev.yaml
index 291b2d73bb..84ab385a2e 100644
--- a/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops-override.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops-override.dev.yaml
@@ -188,12 +188,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops.dev.yaml b/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops.dev.yaml
index f55dbbdbbc..6d0827920e 100644
--- a/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops.dev.yaml
+++ b/packages/kontinuous/tests/__snapshots__/socialgouv-autodevops.dev.yaml
@@ -188,12 +188,18 @@ spec:
 
 
 
-              buildctl_cmd=buildctl-daemonless.sh
+              buildctl_cmd=\\"buildctl \\\\
+                --addr tcp://buildkit-service.buildkit-service.svc:1234 \\\\
+              \\"
 
-              buildctl_options_cache=\\"\\\\
-                --export-cache type=inline \\\\
-                --import-cache type=registry,ref=$IMAGE_PATH:feature-branch-1 \\\\
+              if [ -f /buildkit-certs/cert.pem ]; then
+                buildctl_options_mtls=\\"\\\\
+                  --tlscacert /buildkit-certs/ca.pem \\\\
+                  --tlscert /buildkit-certs/cert.pem \\\\
+                  --tlskey /buildkit-certs/key.pem \\\\
                 \\"
+              fi
+
 
 
               mkdir -p /home/user/.docker
diff --git a/plugins/fabrique/kontinuous.yaml b/plugins/fabrique/kontinuous.yaml
index 6d79bbfe66..d18a43891c 100644
--- a/plugins/fabrique/kontinuous.yaml
+++ b/plugins/fabrique/kontinuous.yaml
@@ -17,6 +17,7 @@ dependencies:
           enableDefaultCharts: true
           mergeValues:
             pgBackupEndpointURL: https://s3.gra.io.cloud.ovh.net
+            buildkitServiceEnabled: true
 
     patches:
       certs: