diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e10c908..e90eac7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,24 +24,27 @@ concurrency:
 
 jobs:
   build:
+    # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master
+    # jobs must opt into it to publish to the public cache.
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
 
-      - uses: cachix/install-nix-action@v27
+      - uses: logos-co/setup-nix-cache-action@v1
         with:
-          extra_nix_config: |
+          attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
+          attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
+          extra-nix-config: |
             experimental-features = nix-command flakes
 
-      - uses: cachix/cachix-action@v15
-        with:
-          name: logos-co
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
       - name: Build logos-dev-boost CLI
         run: nix build -L
 
   scaffold-tests:
+    # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master
+    # jobs must opt into it to publish to the public cache.
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     runs-on: ubuntu-latest
     needs: build
     strategy:
@@ -54,16 +57,13 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: cachix/install-nix-action@v27
+      - uses: logos-co/setup-nix-cache-action@v1
         with:
-          extra_nix_config: |
+          attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
+          attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
+          extra-nix-config: |
             experimental-features = nix-command flakes
 
-      - uses: cachix/cachix-action@v15
-        with:
-          name: logos-co
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
       # git is needed inside the scaffolded project so `nix build` can see
       # the files (flakes only consider git-tracked files).
       - name: Configure git identity for scaffold init
@@ -80,6 +80,9 @@ jobs:
   # builds it, introspects it with lm, runs its unit tests, calls it through
   # logoscore, and asserts on the output.
   doctests:
+    # ATTIC_TOKEN_PUBLIC only exists in the public-cache environment; master
+    # jobs must opt into it to publish to the public cache.
+    environment: ${{ github.ref == 'refs/heads/master' && 'public-cache' || '' }}
     name: dev-boost doc-tests (${{ matrix.os }})
     needs: build
     strategy:
@@ -91,17 +94,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      # DeterminateSystems' installer (instead of cachix/install-nix-action)
-      # because the doc-tests run on macos-latest too, where the cachix installer
-      # collides with the runner's pre-existing _nixbld build users
-      # (eDSRecordAlreadyExists). This installer handles that and enables flakes
-      # by default, so no extra_nix_config is needed.
-      - uses: DeterminateSystems/nix-installer-action@main
-
-      - uses: cachix/cachix-action@v15
+      - uses: logos-co/setup-nix-cache-action@v1
         with:
-          name: logos-co
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          attic-token-ci: ${{ secrets.ATTIC_TOKEN_CI }}
+          attic-token-public: ${{ secrets.ATTIC_TOKEN_PUBLIC }}
 
       # git is needed inside the scaffolded project so `nix build` can see
       # the files (flakes only consider git-tracked files).