diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 33e1ffd..2d9fb77 100755
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -5,44 +5,51 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
-env:
-  USER: runner
-
 jobs:
   nix-fmt:
     runs-on: ubuntu-latest
     steps:
+      - name: checkout code
+        uses: actions/checkout@v6.0.1
       - name: install nix
         uses: https://github.com/cachix/install-nix-action@v31.8.4
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
       - name: set up nix
         run: |
           mkdir -p ~/.config/nix
           echo "experimental-features = nix-command flakes pipe-operators" >> ~/.config/nix/nix.conf
           nix-channel --add https://nixos.org/channels/nixos-unstable nixpkgs
           nix-channel --update
+      - name: restore and save nix store
+        uses: https://github.com/nix-community/cache-nix-action@v6.1.3
+        with:
+          primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', '**/flake.lock') }}
+          restore-prefixes-first-match: nix-${{ runner.os }}-
+          gc-max-store-size-linux: 1G
+          purge: true
+          purge-prefixes: nix-${{ runner.os }}-
+          purge-created: 0
+          purge-last-accessed: 0
+          purge-primary-key: never
       - name: set up nix-community cachix
         uses: https://github.com/cachix/cachix-action@v16
         with:
           name: nix-community
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-      - name: setup git identity
-        run: |
-          git config --global user.name "forgejo-actions-bot"
-          git config --global user.email "actions@forgejo.local"
       - name: import gpg key
         env:
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
         run: |
           echo "$GPG_PRIVATE_KEY" | gpg --batch --import || true
+          echo "default-cache-ttl 3600" >> ~/.gnupg/gpg-agent.conf
+          echo RELOADAGENT | gpg-connect-agent
+      - name: setup git identity
+        run: |
+          git config --global user.name "forgejo-actions-bot"
+          git config --global user.email "actions@forgejo.local"
+
           KEYID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/{print $5;exit}')
           git config --global user.signingkey "$KEYID"
           git config --global commit.gpgsign true
-          echo "default-cache-ttl 3600" >> ~/.gnupg/gpg-agent.conf
-          echo RELOADAGENT | gpg-connect-agent
-      - name: checkout code
-        uses: actions/checkout@v5.0.0
       - name: run nix fmt
         run: nix fmt
       - name: check for changes
@@ -56,10 +63,9 @@ jobs:
       - name: commit and push changes
         if: steps.git_status.outputs.changed == 'true'
         env:
-          TOKEN: ${{ secrets.ACTIONS_TOKEN }}
-          GITEA_SERVER: git.cpatino.com
-          GITEA_REPO: c4patino/yumevim
+          FORGEJO_TOKEN: ${{ forgejo.token }}
+          FORGEJO_REPOSITORY: ${{ forgejo.repository }}
         run: |
           git add -A
           git commit -S -m "style: autoformatting all files with treefmt"
-          git push "https://forgejo:${TOKEN}@${GITEA_SERVER}/${GITEA_REPO}.git" HEAD:main
+          git push "https://${FORGEJO_TOKEN}@git.cpatino.com/${FORGEJO_REPOSITORY}.git" HEAD:main