diff --git a/.github/workflows/appimage.yml b/.github/workflows/appimage.yml
index 4e7873d..4b56af3 100644
--- a/.github/workflows/appimage.yml
+++ b/.github/workflows/appimage.yml
@@ -2,9 +2,6 @@ name: AppImage (Linux, nix)
 
 on:
   workflow_dispatch:
-  push:
-    tags:
-      - 'v*'
 
 permissions:
   contents: read
@@ -26,6 +23,18 @@ jobs:
           extra-conf: |
             experimental-features = nix-command flakes
 
+      - name: Cache /nix/store
+        uses: nix-community/cache-nix-action@v7
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock', '**/Cargo.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 4G
+          purge: true
+          purge-prefixes: nix-${{ runner.os }}-
+          purge-created: 0
+          purge-last-accessed: 0
+          purge-primary-key: never
+
       - name: Build AppImage
         run: nix build --print-build-logs .#appimage
 
@@ -36,7 +45,7 @@ jobs:
           ls -lh out/
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v5
         with:
           name: jayjay-gpui-x86_64.AppImage
           path: out/jayjay-gpui-x86_64.AppImage
diff --git a/flake.nix b/flake.nix
index 9397d59..4f6dfcb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -31,13 +31,25 @@
           zstd
         ];
 
+        # Keep cargo sources + shell/gpui/assets (include_bytes! at compile time).
+        src = pkgs.lib.cleanSourceWith {
+          src = pkgs.lib.cleanSource ./.;
+          filter = path: type:
+            (craneLib.filterCargoSources path type)
+            || (pkgs.lib.hasInfix "/assets/" path);
+          name = "source";
+        };
+
         commonArgs = {
-          src = craneLib.cleanCargoSource ./.;
+          inherit src;
           strictDeps = true;
           cargoExtraArgs = "-p jayjay-gpui";
 
           nativeBuildInputs = with pkgs; [ pkg-config clang ];
           buildInputs = runtimeDeps;
+
+          # Tests run in gpui-ci.yml; nix sandbox has no `jj` on PATH.
+          doCheck = false;
         };
 
         cargoArtifacts = craneLib.buildDepsOnly commonArgs;
@@ -46,8 +58,7 @@
           inherit cargoArtifacts;
           pname = "jayjay-gpui";
 
-          # Bake runtime lib paths into the binary so the AppImage finds Vulkan
-          # / Wayland / X11 after the closure is packaged.
+          # rpath so the AppImage finds the dlopen'd libs after bundling.
           postFixup = ''
             patchelf --set-rpath "${pkgs.lib.makeLibraryPath runtimeDeps}" \
               $out/bin/jayjay-gpui || true