diff --git a/.gitea/workflows/check.yml b/.gitea/workflows/check.yml
index a8c19bb..36533d5 100644
--- a/.gitea/workflows/check.yml
+++ b/.gitea/workflows/check.yml
@@ -54,13 +54,20 @@ jobs:
         # nixbld from its bundled nix.conf, aborting unless that group exists
         # AND has members. Create the nixbld group + build users (what a
         # multi-user install does) before running it.
+        #
+        # Pin the Nix version: the latest (2.34) uses lazy-trees / a git
+        # cache that doesn't materialise flake-input `-source` paths into
+        # the store, so Stylix's import-from-derivation reads fail with
+        # "path '…-source' is not valid". 2.31.5 matches the Nix that wrote
+        # flake.lock locally and evaluates the flake cleanly.
         run: |
+          NIX_VERSION=2.31.5
           groupadd -r nixbld 2>/dev/null || true
           for i in $(seq 1 10); do
             useradd -r -g nixbld -G nixbld -d /var/empty \
               -s /usr/sbin/nologin -c "Nix build user $i" "nixbld$i" 2>/dev/null || true
           done
-          curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
+          curl -L "https://releases.nixos.org/nix/nix-${NIX_VERSION}/install" | sh -s -- --no-daemon
           echo "$HOME/.nix-profile/bin" >> "$GITHUB_PATH"
 
       - name: nix flake check --no-build