diff --git a/.github/workflows/agent-ci.yml b/.github/workflows/agent-ci.yml
index 9d6cc8d27..ef1d02612 100644
--- a/.github/workflows/agent-ci.yml
+++ b/.github/workflows/agent-ci.yml
@@ -91,10 +91,16 @@ jobs:
 
       - name: Install pinned Nix environment
         if: runner.os != 'Windows'
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        if: runner.os != 'Windows'
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install pinned Windows Rust
         if: runner.os == 'Windows'
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable action, exact toolchain below
diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml
index 92d747812..86863473d 100644
--- a/.github/workflows/agent-desktop-build.yml
+++ b/.github/workflows/agent-desktop-build.yml
@@ -94,9 +94,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -141,9 +146,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -193,9 +203,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -237,9 +252,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Cache Agent release dependencies
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32
         with:
@@ -312,9 +332,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
@@ -363,9 +388,14 @@ jobs:
           ref: ${{ github.sha }}
           persist-credentials: false
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
+
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
       - name: Download exact Agent packages
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
diff --git a/.github/workflows/android-build.yml b/.github/workflows/android-build.yml
index d071bb0f3..0afcf7444 100644
--- a/.github/workflows/android-build.yml
+++ b/.github/workflows/android-build.yml
@@ -25,10 +25,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -111,10 +115,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Android artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
diff --git a/.github/workflows/android-pr-build.yml b/.github/workflows/android-pr-build.yml
index 5b7403e24..c6a511ec3 100644
--- a/.github/workflows/android-pr-build.yml
+++ b/.github/workflows/android-pr-build.yml
@@ -25,10 +25,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
diff --git a/.github/workflows/auth-pages-build.yml b/.github/workflows/auth-pages-build.yml
index eb5d68af4..8241a722b 100644
--- a/.github/workflows/auth-pages-build.yml
+++ b/.github/workflows/auth-pages-build.yml
@@ -19,10 +19,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test Pages artifact and deployment boundaries
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.pages
 
diff --git a/.github/workflows/auth-pages-ci.yml b/.github/workflows/auth-pages-ci.yml
index 667cfb5b6..e2f009d85 100644
--- a/.github/workflows/auth-pages-ci.yml
+++ b/.github/workflows/auth-pages-ci.yml
@@ -46,10 +46,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test Pages artifact and deployment boundaries
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.pages
 
diff --git a/.github/workflows/auth-pages-dev-publish.yml b/.github/workflows/auth-pages-dev-publish.yml
index 2de899d32..a5084a5ba 100644
--- a/.github/workflows/auth-pages-dev-publish.yml
+++ b/.github/workflows/auth-pages-dev-publish.yml
@@ -51,10 +51,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts
@@ -108,10 +112,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts
diff --git a/.github/workflows/auth-pages-publish.yml b/.github/workflows/auth-pages-publish.yml
index 293311338..6ddc38994 100644
--- a/.github/workflows/auth-pages-publish.yml
+++ b/.github/workflows/auth-pages-publish.yml
@@ -42,10 +42,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index eba5955a3..223dfbc88 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -28,10 +28,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -97,10 +101,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -176,10 +184,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Linux desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
@@ -201,10 +213,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download macOS desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
@@ -350,10 +366,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Windows desktop artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
diff --git a/.github/workflows/desktop-pr-build.yml b/.github/workflows/desktop-pr-build.yml
index 4b6f62e3f..fb65222b4 100644
--- a/.github/workflows/desktop-pr-build.yml
+++ b/.github/workflows/desktop-pr-build.yml
@@ -34,10 +34,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -91,10 +95,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -127,10 +135,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -266,10 +278,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download Windows artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
diff --git a/.github/workflows/frontend-tests.yml b/.github/workflows/frontend-tests.yml
index 50bdbc448..f064159f2 100644
--- a/.github/workflows/frontend-tests.yml
+++ b/.github/workflows/frontend-tests.yml
@@ -38,10 +38,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
diff --git a/.github/workflows/ios-dev-testflight.yml b/.github/workflows/ios-dev-testflight.yml
index 47aed398d..56432b4d8 100644
--- a/.github/workflows/ios-dev-testflight.yml
+++ b/.github/workflows/ios-dev-testflight.yml
@@ -54,10 +54,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Maple Dev Xcode DerivedData and SourcePackages
         uses: irgaly/xcode-cache@4141f139f00e335c6e1031fb93e667181f86146f # v1
         with:
@@ -144,10 +148,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download this build's Maple Dev artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml
index bc9ef579f..de914c085 100644
--- a/.github/workflows/mobile-build.yml
+++ b/.github/workflows/mobile-build.yml
@@ -50,10 +50,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Xcode DerivedData and SourcePackages
         uses: irgaly/xcode-cache@4141f139f00e335c6e1031fb93e667181f86146f # was v1
         with:
@@ -123,10 +127,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download iOS artifacts
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
diff --git a/.github/workflows/mobile-pr-build.yml b/.github/workflows/mobile-pr-build.yml
index 2dc643f26..d76b0c2f6 100644
--- a/.github/workflows/mobile-pr-build.yml
+++ b/.github/workflows/mobile-pr-build.yml
@@ -29,10 +29,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Xcode DerivedData and SourcePackages
         uses: irgaly/xcode-cache@4141f139f00e335c6e1031fb93e667181f86146f # was v1
         with:
diff --git a/.github/workflows/opensecret-ci.yml b/.github/workflows/opensecret-ci.yml
index a0ac59bb3..354cd7123 100644
--- a/.github/workflows/opensecret-ci.yml
+++ b/.github/workflows/opensecret-ci.yml
@@ -49,10 +49,15 @@ jobs:
           fetch-depth: 0
 
       - name: Install pinned Nix environment
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache backend Rust dependencies
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
@@ -85,10 +90,15 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        working-directory: .
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Check the component flake on this host
         run: nix flake check --no-update-lock-file --print-build-logs '.?submodules=1'
 
diff --git a/.github/workflows/opensecret-eif-release.yml b/.github/workflows/opensecret-eif-release.yml
index 38fd3bdfb..374935285 100644
--- a/.github/workflows/opensecret-eif-release.yml
+++ b/.github/workflows/opensecret-eif-release.yml
@@ -58,11 +58,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install pinned Determinate Nix for FlakeHub authentication
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
-          determinate: true
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Reuse FlakeHub with an Actions cache fallback
         uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3
         with:
@@ -107,11 +110,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
-          determinate: false
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download the attested EIF candidate
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
diff --git a/.github/workflows/opensecret-eif.yml b/.github/workflows/opensecret-eif.yml
index 2268b9a15..f9fc6827a 100644
--- a/.github/workflows/opensecret-eif.yml
+++ b/.github/workflows/opensecret-eif.yml
@@ -56,11 +56,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install pinned Determinate Nix for FlakeHub authentication
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
-          determinate: true
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Reuse FlakeHub with an Actions cache fallback
         uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3
         with:
@@ -113,11 +116,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install pinned Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
-          determinate: false
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       # Fork PRs cannot authenticate to FlakeHub. GitHub scopes cache writes
       # to the PR merge ref; those entries cannot populate master's cache.
       - name: Reuse branch-scoped Nix cache without FlakeHub credentials
@@ -174,11 +180,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install pinned Determinate Nix for FlakeHub authentication
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
-          determinate: true
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Reuse FlakeHub with an Actions cache fallback
         uses: DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea # v3
         with:
diff --git a/.github/workflows/pages-preview-build.yml b/.github/workflows/pages-preview-build.yml
index 9b8db176b..bdbdff6b8 100644
--- a/.github/workflows/pages-preview-build.yml
+++ b/.github/workflows/pages-preview-build.yml
@@ -67,10 +67,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Build with development services
         run: nix develop --no-update-lock-file .#ci -c ./scripts/ci/web.sh
         env:
diff --git a/.github/workflows/pages-production-build.yml b/.github/workflows/pages-production-build.yml
index d97cd37cd..d2d4ccf37 100644
--- a/.github/workflows/pages-production-build.yml
+++ b/.github/workflows/pages-production-build.yml
@@ -19,10 +19,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test Pages artifact and deployment boundaries
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.pages
 
diff --git a/.github/workflows/pages-publish.yml b/.github/workflows/pages-publish.yml
index 3e0a094ef..63f49b619 100644
--- a/.github/workflows/pages-publish.yml
+++ b/.github/workflows/pages-publish.yml
@@ -55,10 +55,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts
@@ -112,10 +116,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Install trusted deployment dependencies
         working-directory: services/updates
         run: nix develop --no-update-lock-file ../..#pages -c bun install --frozen-lockfile --ignore-scripts
diff --git a/.github/workflows/pages-tests.yml b/.github/workflows/pages-tests.yml
index 167eca11f..1e4cd0b92 100644
--- a/.github/workflows/pages-tests.yml
+++ b/.github/workflows/pages-tests.yml
@@ -42,9 +42,13 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test Pages artifact and deployment boundaries
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.pages
diff --git a/.github/workflows/proxy-rust.yml b/.github/workflows/proxy-rust.yml
index f68330c16..e55b6dfc5 100644
--- a/.github/workflows/proxy-rust.yml
+++ b/.github/workflows/proxy-rust.yml
@@ -56,10 +56,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # was v2
         with:
diff --git a/.github/workflows/release-gates-tests.yml b/.github/workflows/release-gates-tests.yml
index 5d75071c8..069b71a56 100644
--- a/.github/workflows/release-gates-tests.yml
+++ b/.github/workflows/release-gates-tests.yml
@@ -71,9 +71,13 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test release gates
         run: nix build --no-link --print-build-logs .#checks.x86_64-linux.release-gates
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f3f837c9a..812c8b2a6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -156,10 +156,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -395,10 +399,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -493,10 +501,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Xcode DerivedData and SourcePackages
         uses: irgaly/xcode-cache@4141f139f00e335c6e1031fb93e667181f86146f # was v1
         with:
@@ -583,10 +595,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -774,10 +790,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -805,10 +825,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -837,10 +861,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -866,10 +894,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -909,10 +941,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -973,10 +1009,14 @@ jobs:
         run: python3 scripts/ci/select-xcode.py
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -1007,10 +1047,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download release artifacts
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/repository-checks.yml b/.github/workflows/repository-checks.yml
index 1333cd91e..dc9aebeda 100644
--- a/.github/workflows/repository-checks.yml
+++ b/.github/workflows/repository-checks.yml
@@ -28,9 +28,13 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Validate repository CI configuration
         run: nix flake check --no-update-lock-file --print-build-logs
diff --git a/.github/workflows/rust-tests.yml b/.github/workflows/rust-tests.yml
index a05a2e9f1..2991537c6 100644
--- a/.github/workflows/rust-tests.yml
+++ b/.github/workflows/rust-tests.yml
@@ -50,10 +50,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache sccache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
diff --git a/.github/workflows/sdk-integration.yml b/.github/workflows/sdk-integration.yml
index 8f5cfd552..184caf606 100644
--- a/.github/workflows/sdk-integration.yml
+++ b/.github/workflows/sdk-integration.yml
@@ -71,10 +71,14 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Migrate the disposable database and build OpenSecret
         run: |
           nix develop --no-update-lock-file './services/opensecret?submodules=1' -c bash -lc '
diff --git a/.github/workflows/sdk-publish-npm.yml b/.github/workflows/sdk-publish-npm.yml
index 6362f7413..bf6323722 100644
--- a/.github/workflows/sdk-publish-npm.yml
+++ b/.github/workflows/sdk-publish-npm.yml
@@ -55,10 +55,14 @@ jobs:
         run: python3 -I scripts/ci/sdk_publish.py source --kind npm --version "$SDK_VERSION" --mode "$SDK_MODE"
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Build and test the exact npm package without publishing credentials
         run: bash scripts/ci/build-sdk-publish.sh npm "$RUNNER_TEMP/sdk-package"
 
diff --git a/.github/workflows/sdk-publish-rust.yml b/.github/workflows/sdk-publish-rust.yml
index 8e4bc6d7f..5ff794eb6 100644
--- a/.github/workflows/sdk-publish-rust.yml
+++ b/.github/workflows/sdk-publish-rust.yml
@@ -55,10 +55,14 @@ jobs:
         run: python3 -I scripts/ci/sdk_publish.py source --kind rust --version "$SDK_VERSION" --mode "$SDK_MODE"
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Build and test the exact crate without publishing credentials
         run: bash scripts/ci/build-sdk-publish.sh rust "$RUNNER_TEMP/sdk-package"
 
diff --git a/.github/workflows/sdk-publish-tests.yml b/.github/workflows/sdk-publish-tests.yml
index af6b57588..fc168f502 100644
--- a/.github/workflows/sdk-publish-tests.yml
+++ b/.github/workflows/sdk-publish-tests.yml
@@ -58,10 +58,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Test publication security boundaries without credentials
         run: nix build --no-update-lock-file --no-link --print-build-logs .#checks.x86_64-linux.sdk-publishing
 
@@ -81,10 +85,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Exercise the real package builder without publishing credentials
         run: bash scripts/ci/build-sdk-publish.sh "$SDK_KIND" "$RUNNER_TEMP/sdk-package"
 
diff --git a/.github/workflows/sdk-rust.yml b/.github/workflows/sdk-rust.yml
index 40976a174..68eaaa700 100644
--- a/.github/workflows/sdk-rust.yml
+++ b/.github/workflows/sdk-rust.yml
@@ -35,10 +35,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Rust dependencies
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # was v2
         with:
diff --git a/.github/workflows/sdk-typescript.yml b/.github/workflows/sdk-typescript.yml
index 9aeef81a8..cfb38e492 100644
--- a/.github/workflows/sdk-typescript.yml
+++ b/.github/workflows/sdk-typescript.yml
@@ -47,10 +47,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
diff --git a/.github/workflows/updates-publish.yml b/.github/workflows/updates-publish.yml
index 0301ad47f..a6db52965 100644
--- a/.github/workflows/updates-publish.yml
+++ b/.github/workflows/updates-publish.yml
@@ -40,10 +40,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Prepare the current release bundle
         id: release
         env:
diff --git a/.github/workflows/updates-tests.yml b/.github/workflows/updates-tests.yml
index 84af5f477..ad0c0168e 100644
--- a/.github/workflows/updates-tests.yml
+++ b/.github/workflows/updates-tests.yml
@@ -35,10 +35,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
diff --git a/.github/workflows/web-build.yml b/.github/workflows/web-build.yml
index 5bca81fc2..46a8d1280 100644
--- a/.github/workflows/web-build.yml
+++ b/.github/workflows/web-build.yml
@@ -39,10 +39,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -78,10 +82,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Cache Bun dependencies
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # was v4
         with:
@@ -125,10 +133,14 @@ jobs:
           persist-credentials: false
 
       - name: Install Nix
-        uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # was v22
+        uses: DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28 # v3.23.3
         with:
+          source-tag: v3.23.3
           github-token: ""
 
+      - name: Verify pinned Nix runtime
+        run: bash scripts/ci/verify-nix-runtime.sh
+
       - name: Download web artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # was v4
         with:
diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md
index 1436d557c..4723e7aa2 100644
--- a/docs/repository-workflows.md
+++ b/docs/repository-workflows.md
@@ -75,6 +75,18 @@ artifacts to TestFlight. Creating a GitHub Release starts release builds and
 downstream publication. Use `$release-maple` only for explicitly requested
 release work, and report the tag and commit before publishing.
 
+## Nix runtime
+
+GitHub Actions jobs use Determinate Nix 3.23.3 through an immutable
+`DeterminateSystems/determinate-nix-action` commit and an explicit
+`source-tag: v3.23.3`. Keep the action revision and source tag synchronized when
+upgrading. `scripts/ci/test_nix_workflows.py` rejects the floating installer,
+an unexpected action revision or tag, installation before checkout, or a missing
+runtime verification step. Each job checks the installed Determinate and
+upstream Nix versions before doing build work. The workflows pass no GitHub
+token to the installer; FlakeHub authentication remains limited to jobs that
+separately receive `id-token: write`.
+
 ## Linux runners
 
 Research desktop/Android compilation and Agent Linux CI/AppImage builds use
diff --git a/flake.nix b/flake.nix
index 7f023d25e..b5e8db9f4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -706,6 +706,7 @@
             nativeBuildInputs = with pkgs; [ actionlint python3 yq-go ];
             src = ./.github/workflows;
             tests = ./scripts/ci/test_codeql_workflow.py;
+            nixTests = ./scripts/ci/test_nix_workflows.py;
             signingTests = ./scripts/ci/test_signing_workflows.py;
           } ''
             cd "$src"
@@ -724,6 +725,8 @@
             cp -R . "$TMPDIR/repo/.github/workflows/"
             cp "$tests" "$TMPDIR/repo/scripts/ci/test_codeql_workflow.py"
             python3 "$TMPDIR/repo/scripts/ci/test_codeql_workflow.py"
+            cp "$nixTests" "$TMPDIR/repo/scripts/ci/test_nix_workflows.py"
+            python3 "$TMPDIR/repo/scripts/ci/test_nix_workflows.py"
             cp "$signingTests" "$TMPDIR/repo/scripts/ci/test_signing_workflows.py"
             python3 "$TMPDIR/repo/scripts/ci/test_signing_workflows.py"
             touch "$out"
diff --git a/scripts/ci/test_agent_workflows.py b/scripts/ci/test_agent_workflows.py
index 46e516e93..96b1858db 100644
--- a/scripts/ci/test_agent_workflows.py
+++ b/scripts/ci/test_agent_workflows.py
@@ -54,7 +54,7 @@ def test_contributor_build_has_no_credentials_or_privileged_events(self):
                     self.assertRegex(action, r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@[0-9a-f]{40}$")
                 if action.startswith("actions/checkout@"):
                     self.assertIs(step["with"]["persist-credentials"], False)
-                if action.startswith("DeterminateSystems/nix-installer-action@"):
+                if action.startswith("DeterminateSystems/determinate-nix-action@"):
                     self.assertEqual(step["with"]["github-token"], "")
 
     def test_agent_cache_and_artifacts_do_not_share_research_publication(self):
@@ -216,7 +216,7 @@ def test_actions_and_checkouts_do_not_grant_publication_or_persist_credentials(s
                 if action.startswith("actions/checkout@"):
                     self.assertEqual(step["with"]["ref"], "${{ github.sha }}")
                     self.assertIs(step["with"]["persist-credentials"], False)
-                if action.startswith("DeterminateSystems/nix-installer-action@"):
+                if action.startswith("DeterminateSystems/determinate-nix-action@"):
                     self.assertEqual(step["with"]["github-token"], "")
                 if action.startswith("Swatinem/rust-cache@"):
                     cache = step["with"]
diff --git a/scripts/ci/test_nix_workflows.py b/scripts/ci/test_nix_workflows.py
new file mode 100644
index 000000000..c020d8ee7
--- /dev/null
+++ b/scripts/ci/test_nix_workflows.py
@@ -0,0 +1,82 @@
+"""Enforce one immutable, security-patched Determinate Nix runtime in CI."""
+
+import functools
+import json
+from pathlib import Path
+import subprocess
+import unittest
+
+
+ROOT = Path(__file__).resolve().parents[2]
+WORKFLOWS = ROOT / ".github" / "workflows"
+PINNED_ACTION = (
+    "DeterminateSystems/determinate-nix-action@"
+    "96c5ee93a9dddf2830d31e1da6ec719077336c28"
+)
+PINNED_INPUTS = {"source-tag": "v3.23.3", "github-token": ""}
+VERIFY_STEP = {
+    "name": "Verify pinned Nix runtime",
+    "run": "bash scripts/ci/verify-nix-runtime.sh",
+}
+EXPECTED_INSTALLS = 69
+
+
+@functools.cache
+def workflow(path):
+    result = subprocess.run(
+        ["yq", "-o=json", ".", str(path)],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return json.loads(result.stdout)
+
+
+class NixWorkflowPinTests(unittest.TestCase):
+    def test_every_nix_installer_is_exactly_pinned_after_checkout(self):
+        installs = []
+        source = "\n".join(path.read_text() for path in sorted(WORKFLOWS.glob("*.yml")))
+        self.assertNotIn("DeterminateSystems/nix-installer-action@", source)
+
+        for path in sorted(WORKFLOWS.glob("*.yml")):
+            config = workflow(path)
+            workflow_directory = (
+                config.get("defaults", {}).get("run", {}).get("working-directory", ".")
+            )
+            for job_name, job in config.get("jobs", {}).items():
+                job_directory = (
+                    job.get("defaults", {}).get("run", {}).get(
+                        "working-directory", workflow_directory
+                    )
+                )
+                steps = job.get("steps", [])
+                for index, step in enumerate(steps):
+                    action = step.get("uses", "")
+                    if not action.startswith("DeterminateSystems/determinate-nix-action@"):
+                        continue
+                    with self.subTest(workflow=path.name, job=job_name):
+                        self.assertEqual(action, PINNED_ACTION)
+                        self.assertEqual(step.get("with"), PINNED_INPUTS)
+                        prior_actions = [item.get("uses", "") for item in steps[:index]]
+                        self.assertTrue(any(
+                            item.startswith("actions/checkout@") for item in prior_actions
+                        ))
+                        self.assertLess(index + 1, len(steps))
+                        verify = steps[index + 1]
+                        self.assertEqual(
+                            {key: verify.get(key) for key in VERIFY_STEP}, VERIFY_STEP
+                        )
+                        self.assertLessEqual(
+                            set(verify), {"name", "run", "if", "working-directory"}
+                        )
+                        self.assertEqual(verify.get("if"), step.get("if"))
+                        self.assertEqual(
+                            verify.get("working-directory", job_directory), "."
+                        )
+                    installs.append((path.name, job_name))
+
+        self.assertEqual(len(installs), EXPECTED_INSTALLS)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/ci/test_opensecret_workflows.py b/scripts/ci/test_opensecret_workflows.py
index a205c8546..24c7634df 100644
--- a/scripts/ci/test_opensecret_workflows.py
+++ b/scripts/ci/test_opensecret_workflows.py
@@ -34,6 +34,7 @@
     'python3 scripts/ci/verify_opensecret_eif_rootfs.py "$EIF_MODE" '
     '"$RUNNER_TEMP/eif-candidate-$EIF_MODE" "$GITHUB_SHA"'
 )
+VERIFY_NIX = "bash scripts/ci/verify-nix-runtime.sh"
 
 
 @functools.cache
@@ -114,8 +115,10 @@ def test_jobs_are_hosted_with_read_only_contents_and_scoped_oidc(self):
                             self.assertIs(step["with"]["persist-credentials"], False)
                             self.assertNotIn("repository", step["with"])
                             self.assertNotIn("ref", step["with"])
-                        if action.startswith("DeterminateSystems/nix-installer-action@"):
-                            self.assertEqual(step["with"]["github-token"], "")
+                        if action.startswith("DeterminateSystems/determinate-nix-action@"):
+                            self.assertEqual(step["with"], {
+                                "source-tag": "v3.23.3", "github-token": "",
+                            })
 
     def test_custom_hosted_runner_is_registered_for_workflow_lint(self):
         result = subprocess.run(
@@ -166,7 +169,7 @@ def test_eif_workflow_preserves_approvals_and_keeps_both_environments_independen
             commands = [step["run"] for step in job["steps"] if "run" in step]
             expected_command = PR_CANDIDATE_BUILD if job_name == "eif-candidate" else (
                                 'bash scripts/ci/check_opensecret_eif.sh "$EIF_MODE"')
-            self.assertEqual(commands, [expected_command] + (
+            self.assertEqual(commands, [VERIFY_NIX, expected_command] + (
                 [PR_ROOTFS_CHECK] if job_name == "eif-candidate" else []
             ))
         for value in strings(config["jobs"]):
@@ -179,37 +182,40 @@ def test_eif_workflow_preserves_approvals_and_keeps_both_environments_independen
 
     def test_eif_cache_setup_precedes_build_and_warms_fork_compatible_cache(self):
         jobs = workflow("opensecret-eif.yml")["jobs"]
-        installer_action = "DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25"
-        for job_name, cache_action, cache_inputs, determinate in (
+        installer_action = "DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28"
+        for job_name, cache_action, cache_inputs in (
             ("eif", "DeterminateSystems/magic-nix-cache-action@3c034b51a9deec0a09ef1df8b436ac5db50fae94", {
                 "source-revision": "4cc363589df8090801c098cdcde1bdd42562318a",
                 "use-flakehub": "disabled",
                 "use-gha-cache": "enabled",
-            }, False),
+            }),
             ("eif-trusted", "DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea", {
                 "diff-store": True,
-            }, True),
+            }),
             ("eif-candidate", "DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea", {
                 "diff-store": True,
-            }, True),
+            }),
         ):
             with self.subTest(job=job_name):
                 steps = jobs[job_name]["steps"]
-                self.assertEqual(len(steps), 5 if job_name == "eif-candidate" else 4)
+                self.assertEqual(len(steps), 6 if job_name == "eif-candidate" else 5)
                 self.assertTrue(steps[0]["uses"].startswith("actions/checkout@"))
                 self.assertEqual(steps[1]["uses"], installer_action)
-                self.assertEqual(steps[1]["with"], {"determinate": determinate, "github-token": ""})
-                self.assertEqual(steps[2]["uses"], cache_action)
-                self.assertEqual(steps[2]["with"], cache_inputs)
-                self.assertNotIn("if", steps[2])
-                self.assertNotIn("continue-on-error", steps[2])
+                self.assertEqual(steps[1]["with"], {
+                    "source-tag": "v3.23.3", "github-token": "",
+                })
+                self.assertEqual(steps[2]["run"], VERIFY_NIX)
+                self.assertEqual(steps[3]["uses"], cache_action)
+                self.assertEqual(steps[3]["with"], cache_inputs)
+                self.assertNotIn("if", steps[3])
+                self.assertNotIn("continue-on-error", steps[3])
                 expected_command = PR_CANDIDATE_BUILD if job_name == "eif-candidate" else (
                                     'bash scripts/ci/check_opensecret_eif.sh "$EIF_MODE"')
-                self.assertEqual(steps[3]["run"], expected_command)
+                self.assertEqual(steps[4]["run"], expected_command)
                 if job_name == "eif-candidate":
-                    self.assertEqual(steps[4]["run"], PR_ROOTFS_CHECK)
-                    self.assertEqual(steps[4]["shell"], "bash")
-                    self.assertNotIn("continue-on-error", steps[4])
+                    self.assertEqual(steps[5]["run"], PR_ROOTFS_CHECK)
+                    self.assertEqual(steps[5]["shell"], "bash")
+                    self.assertNotIn("continue-on-error", steps[5])
 
     def test_eif_event_gate_matches_the_approval_policy(self):
         # Exercise the actual GitHub boolean expression with a restricted,
@@ -294,12 +300,14 @@ def test_backend_retains_exact_rust_gates_and_disabled_stateful_shell_hooks(self
             self.assertEqual(config["env"][key], "0")
         commands = [step["run"] for step in config["jobs"]["rust"]["steps"] if "run" in step]
         self.assertEqual(commands, [
+            VERIFY_NIX,
             "nix develop --no-update-lock-file '.?submodules=1' -c cargo fmt --all -- --check",
             "nix develop --no-update-lock-file '.?submodules=1' -c cargo clippy --locked --all-targets --all-features -- -D warnings",
             "nix develop --no-update-lock-file '.?submodules=1' -c cargo test --locked --all-features",
         ])
         nix_commands = [step["run"] for step in config["jobs"]["nix"]["steps"] if "run" in step]
         self.assertEqual(nix_commands, [
+            VERIFY_NIX,
             "nix flake check --no-update-lock-file --print-build-logs '.?submodules=1'",
             "nix build --no-link --no-update-lock-file '.?submodules=1#default'",
         ])
@@ -396,7 +404,7 @@ def test_selector_failures_or_missing_outputs_cannot_skip_validation(self):
 class EifReleaseWorkflowTests(unittest.TestCase):
     NAME = "opensecret-eif-release.yml"
     CHECKOUT = "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5"
-    INSTALLER = "DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25"
+    INSTALLER = "DeterminateSystems/determinate-nix-action@96c5ee93a9dddf2830d31e1da6ec719077336c28"
 
     def test_release_is_manual_and_never_creates_a_release_or_tag(self):
         config = workflow(self.NAME)
@@ -427,8 +435,10 @@ def test_release_is_manual_and_never_creates_a_release_or_tag(self):
                     self.assertEqual(step["with"], {
                         "persist-credentials": False, "submodules": "recursive", "fetch-depth": 0,
                     })
-                if action.startswith("DeterminateSystems/nix-installer-action@"):
-                    self.assertEqual(step["with"]["github-token"], "")
+                if action.startswith("DeterminateSystems/determinate-nix-action@"):
+                    self.assertEqual(step["with"], {
+                        "source-tag": "v3.23.3", "github-token": "",
+                    })
 
     def test_build_job_is_the_trusted_read_only_builder(self):
         job = workflow(self.NAME)["jobs"]["build"]
@@ -442,19 +452,20 @@ def test_build_job_is_the_trusted_read_only_builder(self):
         self.assertEqual(set(job["outputs"]), {"approval_needed", "pcr0", "eif_sha256", "artifact"})
         steps = job["steps"]
         self.assertEqual([step.get("uses", "run") for step in steps], [
-            self.CHECKOUT, self.INSTALLER,
+            self.CHECKOUT, self.INSTALLER, "run",
             "DeterminateSystems/flakehub-cache-action@1f9a51a2959d3e26c7838c6f3bf9f48acae525ea",
             "run",
             "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
             "actions/attest@281a49d4cbb0a72c9575a50d18f6deb515a11deb",
         ])
-        self.assertEqual(steps[1]["with"], {"determinate": True, "github-token": ""})
-        self.assertEqual(steps[2]["with"], {"diff-store": True})
-        self.assertEqual(steps[3]["run"], 'bash scripts/ci/build_opensecret_eif.sh "$EIF_MODE" eif-artifact')
-        self.assertEqual(steps[4]["with"]["path"], "eif-artifact")
-        self.assertEqual(steps[4]["with"]["if-no-files-found"], "error")
-        self.assertEqual(steps[5]["with"], {"subject-checksums": "eif-artifact/SHA256SUMS"})
-        self.assertNotIn("continue-on-error", steps[5])
+        self.assertEqual(steps[1]["with"], {"source-tag": "v3.23.3", "github-token": ""})
+        self.assertEqual(steps[2]["run"], VERIFY_NIX)
+        self.assertEqual(steps[3]["with"], {"diff-store": True})
+        self.assertEqual(steps[4]["run"], 'bash scripts/ci/build_opensecret_eif.sh "$EIF_MODE" eif-artifact')
+        self.assertEqual(steps[5]["with"]["path"], "eif-artifact")
+        self.assertEqual(steps[5]["with"]["if-no-files-found"], "error")
+        self.assertEqual(steps[6]["with"], {"subject-checksums": "eif-artifact/SHA256SUMS"})
+        self.assertNotIn("continue-on-error", steps[6])
 
     def test_sign_job_is_reviewer_gated_and_exposes_the_key_to_one_step(self):
         job = workflow(self.NAME)["jobs"]["sign"]
@@ -466,25 +477,26 @@ def test_sign_job_is_reviewer_gated_and_exposes_the_key_to_one_step(self):
         self.assertFalse(any("id-token" in value or "flakehub-cache" in value for value in strings(job)))
         steps = job["steps"]
         self.assertEqual([step.get("uses", "run") for step in steps], [
-            self.CHECKOUT, self.INSTALLER,
+            self.CHECKOUT, self.INSTALLER, "run",
             "actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093",
             "bitwarden/sm-action@1238aae8fc64b212641190a9227c8a734ab1a793",
             "run", "run",
         ])
-        self.assertEqual(steps[1]["with"], {"determinate": False, "github-token": ""})
-        self.assertEqual(steps[2]["with"], {"name": "${{ env.APPROVAL_ARTIFACT }}", "path": "eif-artifact"})
-        bitwarden = steps[3]
+        self.assertEqual(steps[1]["with"], {"source-tag": "v3.23.3", "github-token": ""})
+        self.assertEqual(steps[2]["run"], VERIFY_NIX)
+        self.assertEqual(steps[3]["with"], {"name": "${{ env.APPROVAL_ARTIFACT }}", "path": "eif-artifact"})
+        bitwarden = steps[4]
         self.assertEqual(bitwarden["id"], "signing-key")
         self.assertEqual(bitwarden["with"]["access_token"],
                          "${{ secrets.OPENSECRET_PCR_SIGNING_BWS_ACCESS_TOKEN }}")
         self.assertEqual(bitwarden["with"]["secrets"].strip(),
                          "${{ vars.OPENSECRET_PCR_SIGNING_KEY_ID }} > SIGNING_PRIVATE_KEY")
         self.assertIs(bitwarden["with"]["set_env"], False)
-        sign = steps[4]
+        sign = steps[5]
         self.assertEqual(sign["env"], {"SIGNING_PRIVATE_KEY": "${{ steps.signing-key.outputs.SIGNING_PRIVATE_KEY }}"})
         self.assertEqual(sign["run"], "nix develop --no-update-lock-file './services/opensecret?submodules=1#signing'"
                                       ' -c bash services/opensecret/scripts/ci_sign_pcr.sh "$EIF_MODE" eif-artifact')
-        publish = steps[5]
+        publish = steps[6]
         self.assertEqual(publish["env"], {"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}"})
         self.assertEqual(publish["run"], 'bash scripts/ci/publish_opensecret_approval.sh "$EIF_MODE" eif-artifact')
         references = [value for value in strings(job) if "outputs.SIGNING_PRIVATE_KEY" in value]
@@ -1056,7 +1068,10 @@ class SdkWorkflowFailurePropagationTests(unittest.TestCase):
     )
 
     def run_checks(self, name, job, failure=""):
-        steps = [step["run"] for step in workflow(name)["jobs"][job]["steps"] if "run" in step]
+        steps = [
+            step["run"] for step in workflow(name)["jobs"][job]["steps"]
+            if "run" in step and step["run"] != VERIFY_NIX
+        ]
         # Execute the actual nested shell body, without letting an outer -e or
         # host login profile accidentally supply the workflow's missing guard.
         self.assertEqual(len(steps), 1)
diff --git a/scripts/ci/test_pages_auth_workflows.py b/scripts/ci/test_pages_auth_workflows.py
index cf3303a4a..3998c09d0 100644
--- a/scripts/ci/test_pages_auth_workflows.py
+++ b/scripts/ci/test_pages_auth_workflows.py
@@ -240,7 +240,7 @@ def test_publishers_execute_only_trusted_code_and_dependencies(self):
             with self.subTest(workflow=name, target=target):
                 steps = workflow(name)["jobs"][target]["steps"]
                 actions = [step["uses"].split("@")[0] for step in steps if "uses" in step]
-                self.assertEqual(actions, ["actions/checkout", "DeterminateSystems/nix-installer-action"])
+                self.assertEqual(actions, ["actions/checkout", "DeterminateSystems/determinate-nix-action"])
                 self.assertEqual(steps[0]["with"],
                                  {"ref": "${{ github.sha }}", "persist-credentials": False})
                 installs = [step for step in steps if "bun install" in step.get("run", "")]
@@ -290,7 +290,7 @@ def test_actions_are_immutable_without_caches_or_persisted_credentials(self):
                         self.assertNotIn("cache", step["uses"].lower())
                         if step["uses"].startswith("actions/checkout@"):
                             self.assertIs(step["with"]["persist-credentials"], False)
-                        if step["uses"].startswith("DeterminateSystems/nix-installer-action@"):
+                        if step["uses"].startswith("DeterminateSystems/determinate-nix-action@"):
                             self.assertEqual(step["with"]["github-token"], "")
 
 
diff --git a/scripts/ci/test_pages_workflows.py b/scripts/ci/test_pages_workflows.py
index d3ef71ac6..2349f253e 100644
--- a/scripts/ci/test_pages_workflows.py
+++ b/scripts/ci/test_pages_workflows.py
@@ -245,7 +245,7 @@ def test_publisher_uses_only_trusted_checkout_and_dependencies(self):
                     {"ref": "${{ github.sha }}", "persist-credentials": False},
                 )
                 actions = [step["uses"].split("@")[0] for step in job["steps"] if "uses" in step]
-                self.assertEqual(actions, ["actions/checkout", "DeterminateSystems/nix-installer-action"])
+                self.assertEqual(actions, ["actions/checkout", "DeterminateSystems/determinate-nix-action"])
                 installs = [step for step in job["steps"] if "bun install" in step.get("run", "")]
                 self.assertEqual(len(installs), 1)
                 self.assertEqual(installs[0]["working-directory"], "services/updates")
@@ -355,7 +355,7 @@ def test_actions_are_immutable_and_nix_gets_no_github_token(self):
                     with self.subTest(workflow=name, action=step["uses"]):
                         self.assertRegex(step["uses"], r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@[0-9a-f]{40}$")
                         self.assertNotIn("actions/cache@", step["uses"])
-                        if step["uses"].startswith("DeterminateSystems/nix-installer-action@"):
+                        if step["uses"].startswith("DeterminateSystems/determinate-nix-action@"):
                             self.assertEqual(step["with"]["github-token"], "")
 
 
diff --git a/scripts/ci/test_sdk_publish_workflows.py b/scripts/ci/test_sdk_publish_workflows.py
index da1a71ca4..f42d1a329 100644
--- a/scripts/ci/test_sdk_publish_workflows.py
+++ b/scripts/ci/test_sdk_publish_workflows.py
@@ -95,7 +95,7 @@ def test_all_actions_are_pinned_and_checkout_cannot_change_source(self):
                         self.assertNotIn("submodules", step["with"])
                         if kind != "tests":
                             self.assertEqual(step["with"]["ref"], "${{ github.sha }}")
-                    if action.startswith("DeterminateSystems/nix-installer-action@"):
+                    if action.startswith("DeterminateSystems/determinate-nix-action@"):
                         self.assertEqual(step["with"]["github-token"], "")
 
     def test_publishers_only_upload_validated_same_run_artifacts(self):
diff --git a/scripts/ci/verify-nix-runtime.sh b/scripts/ci/verify-nix-runtime.sh
new file mode 100644
index 000000000..36387781f
--- /dev/null
+++ b/scripts/ci/verify-nix-runtime.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+expected='nix (Determinate Nix 3.23.3) 2.35.3'
+actual="$(nix --version)"
+
+if [[ "$actual" != "$expected" ]]; then
+  printf 'error: expected %s, got %s\n' "$expected" "$actual" >&2
+  exit 1
+fi
+
+printf '%s\n' "$actual"