Separate hydra stuff from bootstrap building so we can get good restrictive allowed references