diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index e2efec1..2c7cb7c 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -1,4 +1,5 @@
-# Flake CI: formatting gate + evaluation of every host configuration.
+# Flake CI: full `nix flake check` (formatting + deadnix + statix + pre-commit)
+# plus an explicit per-host evaluation pass for granular output.
 name: CI
 
 on:
@@ -27,9 +28,13 @@ jobs:
           extra_nix_config: |
             experimental-features = nix-command flakes
             accept-flake-config = true
+            substituters = https://cache.nixos.org https://nix-community.cachix.org
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
 
-      - name: Check formatting
-        run: nix build --print-build-logs '.#checks.x86_64-linux.formatting'
+      # Runs every flake check: treefmt formatting, deadnix, statix, and the
+      # pre-commit hooks (so a --no-verify commit can't ship unlinted).
+      - name: Flake check
+        run: nix flake check --print-build-logs
 
       # Evaluate (not build) each host's toplevel so eval errors fail CI cheaply.
       # aarch64 / darwin hosts evaluate fine on an x86_64 runner; only building