diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b1cd222..7b2d49df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -81,6 +81,14 @@ jobs:
           test "$(node -p 'process.versions.node.split(".")[0]')" = "$NODE_VERSION"
           wasm-pack --version
           node --version
+          # wasm-pack uses the shell's wasm-bindgen only at Cargo.lock's exact
+          # version; otherwise it cargo-installs one (71s) — so a lock bump
+          # must move flake.nix's wasmBindgenCli too, and this says so.
+          lock="$(awk '/^name = "wasm-bindgen"$/ {getline; gsub(/[^0-9.]/, ""); print}' Cargo.lock)"
+          test "$(wasm-bindgen --version)" = "wasm-bindgen $lock" || {
+            echo "flake.nix wasmBindgenCli is $(wasm-bindgen --version); Cargo.lock wants $lock" >&2
+            exit 1
+          }
 
       # The same script a developer runs locally, so there is one answer to
       # "how is the bundle built" rather than two that can drift. It builds all
@@ -157,29 +165,21 @@ jobs:
       - name: Every check job gates the deploy
         run: python3 scripts/check-ci-graph.py
 
-  # Too slow on GitHub Actions
-  #
-  # nix-test:
-  #   name: Nix Test
-  #   runs-on: ubuntu-latest
-  #   steps:
-  #     - name: Free up disk space
-  #       run: |
-  #             sudo rm -rf /usr/share/dotnet \
-  #                         /usr/local/lib/android
-  #             sudo df -h
-
-  #     - uses: actions/checkout@v7
-  #     - name: Install Nix
-  #       uses: DeterminateSystems/nix-installer-action@v14
-
-  #     - name: Magic Nix Cache
-  #       uses: DeterminateSystems/magic-nix-cache-action@v8
-
-  #     - name: Check Nix health
-  #       run: nix doctor
-
-  #     - run: nix build
+  # ---------------------------------------------------------------------------
+  # The crate2nix build (Cargo.nix), which `cargo` never exercises. It was off
+  # because GitHub-hosted runners start with an empty store and rebuilt every
+  # dependency crate each run. The NixOS runners substitute from titan's
+  # harmonia first, and titan builds gh/main's `#improvise` hourly, so a PR that
+  # leaves Cargo.lock alone rebuilds only the workspace crates it changed.
+  nix-build:
+    name: Nix build (crate2nix)
+    runs-on: [self-hosted, nixos, microvm]
+    steps:
+      - uses: actions/checkout@v7
+      # Plain bash, not the dev shell: this step needs nix and nothing else.
+      - name: nix build .#improvise
+        shell: bash
+        run: nix build --print-build-logs .#improvise
 
   wasm:
     name: wasm32 check (browser bundle crates)
@@ -410,7 +410,7 @@ jobs:
   # exists to stop.
   pages-deploy:
     name: Deploy to GitHub Pages
-    needs: [test, wasm, js, browser, harness-lint, kb, build]
+    needs: [test, wasm, js, browser, harness-lint, kb, build, nix-build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: [self-hosted, nixos, microvm]
     permissions:
diff --git a/flake.nix b/flake.nix
index 5f323551..8e686b9b 100644
--- a/flake.nix
+++ b/flake.nix
@@ -36,6 +36,25 @@
       cargoNix = import ./Cargo.nix {
         inherit nixpkgs pkgs;
       };
+      # wasm-pack downloads wasm-bindgen and binaryen from GitHub releases
+      # unless they are on PATH, and its downloader ignores SSL_CERT_FILE, so
+      # behind the runners' TLS-auditing proxy those downloads fail (binaryen
+      # with no fallback). On PATH, it downloads nothing. wasm-pack only takes
+      # a PATH wasm-bindgen whose version equals Cargo.lock's `wasm-bindgen`,
+      # so this pin moves with the lock; CI checks that it does.
+      wasmBindgenCli = pkgs.buildWasmBindgenCli rec {
+        src = pkgs.fetchCrate {
+          pname = "wasm-bindgen-cli";
+          version = "0.2.128";
+          hash = "sha256-a7lcXJnnZkYReja+iUO7NqqrWyv3toxnUgQb8s4IS5s=";
+        };
+        cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+          inherit src;
+          inherit (src) pname version;
+          hash = "sha256-R1Tas33Ursy8kqsxguAkG0ZhNed2n5uFTAhw1l2qlLY=";
+        };
+      };
+
       # Everything CI runs, and nothing else: `devShells.ci` is exactly this,
       # and the default shell is this plus editor and release tooling, so a
       # local `nix develop` runs the toolchain the checks run.
@@ -55,6 +74,8 @@
         # loadable page (improvise-d31). Must match WASM_PACK_VERSION in
         # scripts/web-toolchain-versions.env; CI checks that it does.
         pkgs.wasm-pack
+        wasmBindgenCli
+        pkgs.binaryen
 
         # NODE_VERSION's major, same check. The js and browser jobs ran 22
         # while `build` ran the pinned 24; one shell means one node.