diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e9ace9f..fd754cb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,6 @@
 name: CI
 permissions:
   contents: read
-  id-token: write
   actions: write
 
 on:
@@ -10,33 +9,18 @@ on:
     branches: [main]
 
 jobs:
-  checks:
-    name: Nix checks
+  check:
+    name: Format, lint, build & test
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: read
-      actions: write
 
     steps:
       - uses: actions/checkout@v4
         with:
           submodules: recursive
 
-      - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@main
+      - uses: DeterminateSystems/determinate-nix-action@v3
 
-      - name: Set up Nix store cache
-        uses: nix-community/cache-nix-action@v6
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 10G
-          purge: true
-          purge-prefixes: nix-${{ runner.os }}-
-          purge-created: 14
-          purge-last-access: 7
-          purge-primary-key: never
+      - uses: DeterminateSystems/magic-nix-cache-action@main
 
-      - name: Run all flake checks
-        run: nix flake check -L --show-trace
+      - name: Check formatting, clippy lint, unit tests & ort version
+        run: nix flake check --show-trace
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 07041ef..7bd30c8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,29 +26,16 @@ jobs:
           submodules: recursive
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@main
-        with:
-          extra-conf: |
-            experimental-features = nix-command flakes
+        uses: DeterminateSystems/determinate-nix-action@v3
 
-      - name: Set up Nix store cache
-        uses: nix-community/cache-nix-action@v6
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 10G
-          purge: true
-          purge-prefixes: nix-${{ runner.os }}-
-          purge-created: 14
-          purge-last-access: 7
-          purge-primary-key: never
+      - uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Read ORT version from flake
         id: ort_version
         run: echo "value=$(nix eval .#lib.ortVersion --raw)" >> "$GITHUB_OUTPUT"
 
       - name: Verify ort-version matches nixpkgs onnxruntime
-        run: nix flake check --system x86_64-linux -L
+        run: nix flake check --system x86_64-linux
 
       - name: Install dist
         shell: bash
@@ -217,19 +204,9 @@ jobs:
           submodules: recursive
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@main
+        uses: DeterminateSystems/determinate-nix-action@v3
 
-      - name: Set up Nix store cache
-        uses: nix-community/cache-nix-action@v6
-        with:
-          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock', 'Cargo.lock') }}
-          restore-prefixes-first-match: nix-${{ runner.os }}-
-          gc-max-store-size-linux: 10G
-          purge: true
-          purge-prefixes: nix-${{ runner.os }}-
-          purge-created: 14
-          purge-last-access: 7
-          purge-primary-key: never
+      - uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: Build Docker image with Nix
         run: nix build .#dockerImage -L --show-trace
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca4fb96..fe534e2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## Unreleased
 
+- Infra: CI workflow fixes. CI is now a nix flake check which includes compilation, caching and running tests, clippy, fmt, validation for ort version.
 - Docker-compose: The example now references the ghcr image, this is so we can remove the Dockerfile and reducing maintenance scope.
 - Refactor: web scraping now uses `servo-fetch` (pure-Rust Servo engine) and PDF rendering uses `pdfium-render` (direct PDFium bindings) — reduces Docker image size by ~300MB, improves startup latency by ~100× for PDF rendering, and provides more stable output
 - Fix: added `pkgs.libglvnd` to `LD_LIBRARY_PATH` in devenv so Servo engine can find `libEGL.so` at runtime