diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index be7af1f62..0fa1730b5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -80,7 +80,9 @@ jobs:
         id: cache-nimbledeps
         uses: actions/cache@v3
         with:
-          path: nimbledeps/
+          path: |
+            nimbledeps/
+            nimble.paths
           key: ${{ runner.os }}-nimbledeps-${{ hashFiles('nimble.lock') }}
 
       - name: Install nimble deps
@@ -139,7 +141,9 @@ jobs:
         id: cache-nimbledeps
         uses: actions/cache@v3
         with:
-          path: nimbledeps/
+          path: |
+            nimbledeps/
+            nimble.paths
           key: ${{ runner.os }}-nimbledeps-${{ hashFiles('nimble.lock') }}
 
       - name: Install nimble deps
@@ -224,7 +228,9 @@ jobs:
         id: cache-nimbledeps
         uses: actions/cache@v3
         with:
-          path: nimbledeps/
+          path: |
+            nimbledeps/
+            nimble.paths
           key: ${{ runner.os }}-nimbledeps-${{ hashFiles('nimble.lock') }}
 
       - name: Install nimble deps
diff --git a/.github/workflows/container-image.yml b/.github/workflows/container-image.yml
index 5ed9b3171..c261d3e8d 100644
--- a/.github/workflows/container-image.yml
+++ b/.github/workflows/container-image.yml
@@ -66,7 +66,9 @@ jobs:
         id: cache-nimbledeps
         uses: actions/cache@v3
         with:
-          path: nimbledeps/
+          path: |
+            nimbledeps/
+            nimble.paths
           key: ${{ runner.os }}-nimbledeps-${{ hashFiles('nimble.lock') }}
 
       - name: Install nimble deps
diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml
index cab8e3ddd..3489344f4 100644
--- a/.github/workflows/windows-build.yml
+++ b/.github/workflows/windows-build.yml
@@ -83,7 +83,9 @@ jobs:
       id: cache-nimbledeps
       uses: actions/cache@v4
       with:
-        path: nimbledeps/
+        path: |
+            nimbledeps/
+            nimble.paths
         key: ${{ runner.os }}-nimbledeps-${{ hashFiles('nimble.lock') }}
 
     - name: Install nimble deps
diff --git a/Makefile b/Makefile
index 0c32da864..016428fb8 100644
--- a/Makefile
+++ b/Makefile
@@ -67,7 +67,12 @@ waku.nims:
 	ln -s waku.nimble $@
 
 $(NIMBLEDEPS_STAMP): nimble.lock | waku.nims
-	nimble setup --localdeps
+	# nim/nimble in nimble.lock have platform-specific checksums; strip before
+	# setup and restore afterwards to keep the versioned file intact.
+	cp nimble.lock nimble.lock.bak
+	python3 -c "import json; lock=json.load(open('nimble.lock')); [lock['packages'].pop(k,None) for k in ['nim','nimble']]; json.dump(lock,open('nimble.lock','w'),indent=2)"
+	nimble setup --localdeps || { mv nimble.lock.bak nimble.lock; exit 1; }
+	mv nimble.lock.bak nimble.lock
 	$(MAKE) build-nph
 	$(MAKE) rebuild-bearssl-nimbledeps
 	touch $@
@@ -85,8 +90,8 @@ clean:
 	rm nimble.paths 2> /dev/null || true
 	nimble clean
 
-REQUIRED_NIM_VERSION    := $(shell grep -E '^const NimVersion\s*=' waku.nimble | grep -oE '"[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"')
-REQUIRED_NIMBLE_VERSION := $(shell grep -E '^const NimbleVersion\s*=' waku.nimble | grep -oE '"[0-9]+\.[0-9]+\.[0-9]+"' | tr -d '"')
+REQUIRED_NIM_VERSION    := $(shell grep -E '^requires "nim ==' waku.nimble | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+REQUIRED_NIMBLE_VERSION := $(shell grep -E '^requires "nimble ==' waku.nimble | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
 
 build:
 	@nim_ver=$$(nim --version 2>/dev/null | head -1 | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1); \
diff --git a/nimble.lock b/nimble.lock
index 6460cef3e..8b6327071 100644
--- a/nimble.lock
+++ b/nimble.lock
@@ -471,6 +471,16 @@
         "sha1": "fa2a7552c6ec860717b77ce34cf0b7afe4570234"
       }
     },
+    "nim": {
+      "version": "2.2.8",
+      "vcsRevision": "",
+      "url": "https://github.com/nim-lang/Nim.git",
+      "downloadMethod": "git",
+      "dependencies": [],
+      "checksums": {
+        "sha1": "dbea2685008ca7504c044fdbcf68abf4bf9931b2"
+      }
+    },
     "presto": {
       "version": "0.1.1",
       "vcsRevision": "d66043dd7ede146442e6c39720c76a20bde5225f",
diff --git a/nix/nim.nix b/nix/nim.nix
index 48c311cb0..9e3bd823c 100644
--- a/nix/nim.nix
+++ b/nix/nim.nix
@@ -6,10 +6,10 @@
 #     nix-prefetch-git --url https://github.com/nim-lang/Nim.git --rev v<version> --fetch-submodules
 { pkgs }:
 let
-  lines      = pkgs.lib.splitString "\n" (builtins.readFile ../waku.nimble);
+  lines       = pkgs.lib.splitString "\n" (builtins.readFile ../waku.nimble);
   versionLine = builtins.head (builtins.filter
-    (l: builtins.match "^const NimVersion.*" l != null) lines);
-  version    = builtins.head (builtins.match ".*\"([0-9]+\\.[0-9]+\\.[0-9]+)\".*" versionLine);
+    (l: builtins.match "^requires \"nim ==.*" l != null) lines);
+  version     = builtins.head (builtins.match ".*([0-9]+\\.[0-9]+\\.[0-9]+).*" versionLine);
 in
 pkgs.fetchgit {
   url = "https://github.com/nim-lang/Nim.git";
diff --git a/nix/nimble.nix b/nix/nimble.nix
index 242173cd4..3a773aa5a 100644
--- a/nix/nimble.nix
+++ b/nix/nimble.nix
@@ -6,8 +6,8 @@
 let
   lines       = pkgs.lib.splitString "\n" (builtins.readFile ../waku.nimble);
   versionLine = builtins.head (builtins.filter
-    (l: builtins.match "^const NimbleVersion.*" l != null) lines);
-  version     = builtins.head (builtins.match ".*\"([0-9]+\\.[0-9]+\\.[0-9]+)\".*" versionLine);
+    (l: builtins.match "^requires \"nimble ==.*" l != null) lines);
+  version     = builtins.head (builtins.match ".*([0-9]+\\.[0-9]+\\.[0-9]+).*" versionLine);
 in
 pkgs.fetchgit {
   url = "https://github.com/nim-lang/nimble";
diff --git a/waku.nimble b/waku.nimble
index 146c95d63..659b5fc94 100644
--- a/waku.nimble
+++ b/waku.nimble
@@ -10,11 +10,9 @@ description = "Waku, Private P2P Messaging for Resource-Restricted Devices"
 license = "MIT or Apache License 2.0"
 #bin           = @["build/waku"]
 
-## Required toolchain versions — defined as constants so they are enforced at
-## build time (via the Makefile) without being added to nimble.lock, which would
-## embed platform-specific checksums and cause cross-platform mismatch errors.
-const NimVersion    = "2.2.4"
-const NimbleVersion = "0.18.2"
+## nim/nimble are stripped from nimble.lock before setup to avoid cross-platform checksum errors.
+requires "nim == 2.2.4"
+requires "nimble == 0.18.2"
 
 ### Dependencies
 requires "chronos >= 4.2.0",