This was previously run from the untrusted checkout, which would allow extracting the cachix secret easily.