@@ -26,6 +26,15 @@ runs:
           nix build .#ccusage-static --print-build-logs
         fi
 
+    # Root the deps so the cache-nix-action gc-max trim keeps them while
+    # dropping stale paths. On PR runs (nix-github-token == 'false') the pin's
+    # nix build / eval must disable access tokens too.
+    - uses: ./.github/actions/pin-nix-deps
+      env:
+        NIX_CONFIG: ${{ inputs.nix-github-token == 'false' && 'access-tokens =' || '' }}
+      with:
+        attr: .#ccusage-static.cargoArtifacts
+
     - name: Verify Linux binary is static
       shell: bash
       env:
 
@@ -1,10 +1,11 @@
 name: Setup Linux Nix (action cache, macOS-style)
 description: >
   Install Nix and restore/save the store with cache-nix-action, mirroring the
-  macOS setup. No gc-max-store-size: the Blacksmith cache backend is unlimited,
-  so we never garbage-collect before saving — the whole store (including the
-  unrooted crane deps) is cached, exactly like macOS where the small store keeps
-  GC from running ("Not collecting garbage").
+  macOS setup. cache-nix-action only caches non-substitutable paths (the crane
+  deps, not the cache.nixos.org toolchain), so the cache stays small (~900MB).
+  gc-max-store-size bounds it so old deps generations and stale build outputs do
+  not accumulate across runs; the deps profile pin keeps the current deps rooted
+  so the GC trims everything except what the next build reuses.
 runs:
   using: composite
   steps:
@@ -20,6 +21,7 @@ runs:
       with:
         primary-key: nix-buildnative-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('flake.lock', 'flake.nix', 'package.nix', 'nix/**/*.nix', 'rust-toolchain.toml', 'rust/Cargo.lock') }}
         restore-prefixes-first-match: nix-buildnative-${{ runner.os }}-${{ runner.arch }}-
+        gc-max-store-size-linux: 2000000000
         purge: true
         purge-prefixes: nix-buildnative-${{ runner.os }}-${{ runner.arch }}-
         purge-created: 172800
 
@@ -79,15 +79,6 @@ jobs:
     needs: changes
     if: needs.changes.outputs.code-changed == 'true'
     name: ${{ matrix.name }}
-    # Each native build shares one per-job, per-arch Blacksmith sticky disk
-    # across every run. Overlapping runs clone the same snapshot and re-commit
-    # wholesale, so a later run overwrites the deps another run just pinned and
-    # both rebuild from scratch. Serialize runs of the same matrix entry (queue,
-    # don't cancel) so the pinned deps survive and stay warm. The key is per
-    # matrix.name because each entry already has its own disk.
-    concurrency:
-      group: build-native-${{ matrix.name }}
-      cancel-in-progress: false
     permissions:
       actions: write
       contents: read