diff --git a/.taskcluster.yml b/.taskcluster.yml
index 494d31a7b0..cd75889ac1 100644
--- a/.taskcluster.yml
+++ b/.taskcluster.yml
@@ -1,47 +1,30 @@
----
-version: 0
-metadata:
-  name: "NSS Continuous Integration"
-  description: "The Taskcluster task graph for the NSS tree"
-  owner: "mozilla-taskcluster-maintenance@mozilla.com"
-  source: {{{source}}}
-
-scopes:
-  # Note the below scopes are insecure however these get overriden on the server
-  # side to whatever scopes are set by mozilla-taskcluster.
-  - queue:*
-  - docker-worker:*
-  - scheduler:*
-
-# Available mustache parameters (see the mozilla-taskcluster source):
-#
-# - owner:          push user (email address)
-# - source:         URL of this YAML file
-# - url:            repository URL
-# - project:        alias for the destination repository (basename of
-#                   the repo url)
-# - level:          SCM level of the destination repository
-#                   (1 = try, 3 = core)
-# - revision:       (short) hg revision of the head of the push
-# - revision_hash:  (long) hg revision of the head of the push
-# - comment:        comment of the push
-# - pushlog_id:     id in the pushlog table of the repository
-#
-# and functions:
-# - as_slugid:      convert a label into a slugId
-# - from_now:       generate a timestamp at a fixed offset from now
+# This file is rendered via JSON-e in a hook with context:
+#   {
+#     tasks_for: 'hg-push',
+#     push: {owner, pushlog_id, pushdate},
+#     repository: {url, project, level},
+#     now,
+#     ownTaskId: // taskId of the task that will be created
+#   }
 
+version: 1
 tasks:
-  - taskId: '{{#as_slugid}}decision task{{/as_slugid}}'
-    reruns: 3
-    task:
-      created: '{{now}}'
-      deadline: '{{#from_now}}1 day{{/from_now}}'
-      expires: '{{#from_now}}14 days{{/from_now}}'
+  - $let:
+      # sometimes the push user is just `ffxbld` or the like, but we want an email-like field..
+      ownerEmail: {$if: '"@" in push.owner', then: '${push.owner}', else: '${push.owner}@noreply.mozilla.org'}
+      # ensure there's no trailing `/` on the repo URL
+      repoUrl: {$if: 'repository.url[-1] == "/"', then: {$eval: 'repository.url[:-1]'}, else: {$eval: 'repository.url'}}
+    in:
+      taskId: '${ownTaskId}'
+      taskGroupId: '${ownTaskId}'
+      schedulerId: 'gecko-level-nss'
+      created: {$fromNow: ''}
+      deadline: {$fromNow: '1 day'}
+      expires: {$fromNow: '14 days'}
 
       metadata:
         owner: mozilla-taskcluster-maintenance@mozilla.com
-        source: {{{source}}}
+        source: "${repository.url}"
         name: "NSS Decision Task"
         description: |
             The task that creates all of the other tasks in the task graph
@@ -49,24 +32,26 @@ tasks:
       workerType: "hg-worker"
       provisionerId: "aws-provisioner-v1"
 
+      scopes:
+        - 'assume:repo:${repoUrl[8:]}:branch:default'
+        - 'queue:route:notify.email.${ownerEmail}.*'
       tags:
-        createdForUser: {{owner}}
+        createdForUser: "${ownerEmail}"
 
       routes:
-        - "tc-treeherder-stage.v2.{{project}}.{{revision}}.{{pushlog_id}}"
-        - "tc-treeherder.v2.{{project}}.{{revision}}.{{pushlog_id}}"
+        - "tc-treeherder-stage.v2.${repository.project}.${push.revision}.${push.pushlog_id}"
+        - "tc-treeherder.v2.${repository.project}.${push.revision}.${push.pushlog_id}"
 
       payload:
-        image: nssdev/nss-decision:0.0.2
+        image: djmitche/nss-decision:0.0.3  # TODO: nssdev, not djmitche, once the image is pushed there
 
         env:
-          TC_OWNER: {{owner}}
-          TC_SOURCE: {{{source}}}
-          TC_PROJECT: {{project}}
-          TC_COMMENT: '{{comment}}'
-          NSS_PUSHLOG_ID: '{{pushlog_id}}'
-          NSS_HEAD_REPOSITORY: '{{{url}}}'
-          NSS_HEAD_REVISION: '{{revision}}'
+          TC_OWNER: "${push.owner}"
+          TC_SOURCE: "${repository.url}"
+          TC_PROJECT: ${repository.project}
+          NSS_PUSHLOG_ID: '${push.pushlog_id}'
+          NSS_HEAD_REPOSITORY: '${repository.url}'
+          NSS_HEAD_REVISION: '${push.revision}'
 
         maxRunTime: 1800