diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 96a5b8cd2..017861b47 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -149,31 +149,20 @@ jobs:
           echo "=== Nim version ==="
           nim --version
 
-      - name: Debug nimble.paths
-        run: |
-          echo "=== Nim version ==="
-          nim --version
-          echo "=== nimble version ==="
-          nimble --version
-          echo "=== nimble.paths content ==="
-          cat nimble.paths || echo "nimble.paths not found"
-          echo "=== Check for empty paths ==="
-          grep -n '""' nimble.paths || echo "No empty paths found"
-          grep -n '^--path:$' nimble.paths || echo "No empty --path: entries"
-          echo "=== Verify nimcrypto is in paths ==="
-          grep -c nimcrypto nimble.paths || echo "WARNING: nimcrypto not found in nimble.paths!"
+      - name: Restore deps from cache
+        id: deps-cache
+        uses: actions/cache@v4
+        with:
+          path: nimbledeps
+          key: nimbledeps-${{ matrix.builder }}-${{ matrix.platform.cpu }}-${{ hashFiles('.pinned') }}
+
+      - name: Install deps
+        if: ${{ steps.deps-cache.outputs.cache-hit != 'true' }}
+        run: nimble install_pinned
 
       - name: Make update
         run: make update
 
-      - name: Check arch of loaded dependencies
-        if: runner.os != 'Windows'
-        run: |
-          find . -name upnpdev.o -exec file {} \;
-          find . -name ssl_scert_single_rsa.o -exec file {} \;
-          find . -name ssl_server.o -exec file {} \;
-          find . -name ssl_server_full_ec.o -exec file {} \;
-
       - name: Build binaries
         run: make V=1 QUICK_AND_DIRTY_COMPILER=1 USE_LIBBACKTRACE=0 all
 
@@ -283,26 +272,20 @@ jobs:
           echo "=== gcc version ==="
           gcc --version || echo "gcc not available"
 
-      - name: Cache nimble deps
+      - name: Restore deps from cache
+        id: deps-cache
         uses: actions/cache@v4
         with:
-          path: |
-            nimbledeps/pkgs2
-            ~/.cache
-          key: nimble-${{ runner.os }}-${{ runner.arch }}-${{ matrix.platform.cc }}-${{ hashFiles('waku.nimble') }}
-          restore-keys: nimble-${{ runner.os }}-${{ runner.arch }}-${{ matrix.platform.cc }}
+          path: nimbledeps
+          key: nimbledeps-${{ matrix.builder }}-${{ matrix.platform.cpu }}-${{ hashFiles('.pinned') }}
+
+      - name: Install deps
+        if: ${{ steps.deps-cache.outputs.cache-hit != 'true' }}
+        run: nimble install_pinned
 
       - name: Make update
         run: make update
 
-      - name: Verify nimble.paths
-        run: |
-          echo "=== nimble.paths content ==="
-          cat nimble.paths || { echo "ERROR: nimble.paths not found!"; exit 1; }
-          echo "=== Verify critical dependencies ==="
-          grep -q nimcrypto nimble.paths || { echo "ERROR: nimcrypto not in paths!"; exit 1; }
-          grep -q libp2p nimble.paths || { echo "ERROR: libp2p not in paths!"; exit 1; }
-
       - name: Run tests
         if: runner.os != 'Windows'
         run: |
diff --git a/.gitignore b/.gitignore
index 5222a0d5e..a10810544 100644
--- a/.gitignore
+++ b/.gitignore
@@ -89,5 +89,6 @@ AGENTS.md
 nimble.develop
 nimble.paths
 nimbledeps
+.pinned
 
 **/anvil_state/state-deployed-contracts-mint-and-approved.json
diff --git a/waku.nimble b/waku.nimble
index ea74b99e4..295853bc6 100644
--- a/waku.nimble
+++ b/waku.nimble
@@ -58,6 +58,39 @@ requires "nim >= 2.2.4",
 # Packages not on nimble (use git URLs)
 requires "https://github.com/logos-messaging/nim-ffi"
 
+### Pinned dependencies — source of truth is nimble.lock
+
+task install_pinned, "Install dependencies pinned in nimble.lock":
+  import json, sequtils, strutils
+
+  let lock = parseFile("nimble.lock")
+  var toInstall: seq[(string, string)]
+  for name, pkg in lock["packages"].pairs:
+    let url = pkg["url"].getStr().strip(chars = {'/'})
+    let urlClean = if url.endsWith(".git"): url[0 .. ^5] else: url
+    let rev = pkg["vcsRevision"].getStr()
+    toInstall.add((name, urlClean & "@#" & rev))
+
+  rmDir("nimbledeps")
+  mkDir("nimbledeps")
+  exec "nimble install -y " & toInstall.mapIt(it[1]).join(" ")
+
+  let nimblePkgs =
+    if system.dirExists("nimbledeps/pkgs"): "nimbledeps/pkgs" else: "nimbledeps/pkgs2"
+  for dependency in listDirs(nimblePkgs):
+    let
+      fileName = dependency.extractFilename
+      fileContent = readFile(dependency & "/nimblemeta.json")
+      packageName = fileName.split('-')[0]
+
+    if toInstall.anyIt(
+      it[0] == packageName and (
+        it[1].split('#')[^1] in fileContent or
+        fileName.endsWith(it[1].split('#')[^1])
+      )
+    ) == false or fileName.split('-')[^1].len < 20:
+      rmDir(dependency)
+
 ### Helper functions
 proc buildModule(filePath, params = "", lang = "c"): bool =
   if not dirExists "build":