diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ef3c71ca4fbe..b00335dc5f27 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -61,9 +61,11 @@ jobs:
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: '(-source$|-nixpkgs-tarball-)'
 
       - run: nix-env --install -f pinned -A nix-build-uncached
 
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index c06729fa7f5d..3dbbb9d2dff7 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -112,9 +112,11 @@ jobs:
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
-          # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
-          name: nixpkgs-ci
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
 
       - name: Build codeowners validator
         run: nix-build trusted/ci --arg nixpkgs ./pinned -A codeownersValidator
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index a89f2e4d5f9b..a1aaaafe6fbb 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -16,6 +16,8 @@ on:
         default: false
         type: boolean
     secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
       OWNER_APP_PRIVATE_KEY:
         required: false
 
@@ -97,6 +99,14 @@ jobs:
       - name: Install Nix
         uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
 
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: '(-source|-single-chunk)$'
+
       - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 44cb7fe7bada..d9168c4210d0 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -9,6 +9,9 @@ on:
       targetSha:
         required: true
         type: string
+    secrets:
+      CACHIX_AUTH_TOKEN:
+        required: true
 
 permissions: {}
 
@@ -33,6 +36,10 @@ jobs:
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
 
+      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
+      # because the cache would be invalidated on every commit - treefmt checks every file.
+      # Maybe we can cache treefmt's eval-cache somehow.
+
       - name: Check that files are formatted
         run: |
           # Note that it's fine to run this on untrusted code because:
@@ -65,6 +72,14 @@ jobs:
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
 
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
+
       - name: Parse all nix files
         run: |
           # Tests multiple versions at once, let's make sure all of them run, so keep-going.
@@ -88,6 +103,14 @@ jobs:
 
       - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
 
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
+        with:
+          # The nixpkgs-ci cache should not be trusted or used outside of Nixpkgs and its forks' CI.
+          name: ${{ vars.CACHIX_NAME || 'nixpkgs-ci' }}
+          extraPullNames: nixpkgs-ci
+          authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+          pushFilter: -source$
+
       - name: Running nixpkgs-vet
         env:
           # Force terminal colors to be enabled. The library that `nixpkgs-vet` uses respects https://bixense.com/clicolors/
diff --git a/.github/workflows/merge-group.yml b/.github/workflows/merge-group.yml
index 72b8deeb2dbc..9ed7125c76d2 100644
--- a/.github/workflows/merge-group.yml
+++ b/.github/workflows/merge-group.yml
@@ -9,6 +9,8 @@ jobs:
   lint:
     name: Lint
     uses: ./.github/workflows/lint.yml
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
       mergedSha: ${{ github.event.merge_group.head_sha }}
       targetSha: ${{ github.event.merge_group.base_sha }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 1de7d6614c9c..b6c4fabafa12 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -100,6 +100,8 @@ jobs:
     name: Lint
     needs: [prepare]
     uses: ./.github/workflows/lint.yml
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
@@ -112,6 +114,7 @@ jobs:
       # compare
       statuses: write
     secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
       OWNER_APP_PRIVATE_KEY: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
     with:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index ae829ed0ff2b..265f0fba8927 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -43,6 +43,8 @@ jobs:
       issues: write
       pull-requests: write
       statuses: write
+    secrets:
+      CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }}
     with:
       mergedSha: ${{ github.sha }}
       systems: ${{ needs.prepare.outputs.systems }}
diff --git a/ci/nixpkgs-vet.nix b/ci/nixpkgs-vet.nix
index 58b5024589bd..7c11dffc4f9b 100644
--- a/ci/nixpkgs-vet.nix
+++ b/ci/nixpkgs-vet.nix
@@ -13,9 +13,15 @@ let
     with lib.fileset;
     path:
     toSource {
-      fileset = (gitTracked path);
+      fileset = difference (gitTracked path) (unions [
+        (path + /.github)
+        (path + /ci)
+      ]);
       root = path;
     };
+
+  filteredBase = filtered base;
+  filteredHead = filtered head;
 in
 runCommand "nixpkgs-vet"
   {
@@ -27,11 +33,11 @@ runCommand "nixpkgs-vet"
   ''
     export NIX_STATE_DIR=$(mktemp -d)
 
-    nixpkgs-vet --base ${filtered base} ${filtered head}
+    nixpkgs-vet --base ${filteredBase} ${filteredHead}
 
     # TODO: Upstream into nixpkgs-vet, see:
     # https://github.com/NixOS/nixpkgs-vet/issues/164
-    badFiles=$(find ${filtered head}/pkgs -type f -name '*.nix' -print | xargs grep -l '^[^#]*<nixpkgs/' || true)
+    badFiles=$(find ${filteredHead}/pkgs -type f -name '*.nix' -print | xargs grep -l '^[^#]*<nixpkgs/' || true)
     if [[ -n $badFiles ]]; then
       echo "Nixpkgs is not allowed to use <nixpkgs> to refer to itself."
       echo "The offending files:"
@@ -41,7 +47,7 @@ runCommand "nixpkgs-vet"
 
     # TODO: Upstream into nixpkgs-vet, see:
     # https://github.com/NixOS/nixpkgs-vet/issues/166
-    conflictingPaths=$(find ${filtered head} | awk '{ print $1 " " tolower($1) }' | sort -k2 | uniq -D -f 1 | cut -d ' ' -f 1)
+    conflictingPaths=$(find ${filteredHead} | awk '{ print $1 " " tolower($1) }' | sort -k2 | uniq -D -f 1 | cut -d ' ' -f 1)
     if [[ -n $conflictingPaths ]]; then
       echo "Files in nixpkgs must not vary only by case."
       echo "The offending paths:"