diff --git a/docs/deployment.md b/docs/deployment.md
index fee808c..e47921f 100644
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -68,6 +68,10 @@ The shared GUI home-manager module installs Codex from the `llm-agents` input, r
 that input's tested nixpkgs pin. Run `nix flake update llm-agents`, then switch the system
 or home configuration to use the updated package.
 
+The shared cache settings in `lib.my.c.nix.cache` and the flake's `nixConfig` include
+the [Numtide binary cache](https://github.com/numtide/llm-agents.nix#binary-cache), so
+Codex can be downloaded prebuilt. Keep the input's tested nixpkgs pin to preserve cache hits.
+
 `programs.codex.mutableSettings` merges the declared status-line settings into the writable
 `~/.codex/config.toml` during activation. Declared values take precedence on each switch;
 other settings, including model selection, providers and project trust, remain imperative.
@@ -178,8 +182,8 @@ are unchanged, and the Determinate NixOS module is deliberately not imported.
   Determinate without further change.
 - **`accept-flake-config`.** Set true only in the devshell `nix.conf`, `.envrc` (as
   `--accept-flake-config`, for direnv) and CI — the contexts that build this flake — so its
-  `nixConfig` (the Harmonia cache) is trusted without an interactive prompt. It is deliberately not
-  set system-wide: boxes already trust that cache via `nix.settings`, so a global setting would only
+  `nixConfig` (the Harmonia and Numtide caches) is trusted without an interactive prompt. It is
+  deliberately not set system-wide: boxes already trust those caches via `nix.settings`, so a global setting would only
   blanket-trust every flake's `nixConfig` for no gain.
 
 ## Secrets
diff --git a/flake.nix b/flake.nix
index 751fa91..cb30293 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,16 +1,18 @@
 {
   description = "System configs";
 
-  # Offer our Harmonia cache when building the flake itself, so `nix develop` / `nix build` don't
+  # Offer our Harmonia and Numtide caches when building the flake, so `nix develop` / `nix build` don't
   # rebuild from source. Nix reads `nixConfig` before the flake evaluates and rejects any computed
   # value (imports/thunks), so these must stay literal — keep them in sync with `lib.my.c.nix.cache`.
   # Consumers must trust these (accept-flake-config / a trusted user) for them to take effect.
   nixConfig = {
     extra-substituters = [
       "https://nix-cache.nul.ie"
+      "https://cache.numtide.com"
     ];
     extra-trusted-public-keys = [
       "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+      "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
     ];
   };
 
diff --git a/lib/constants.nix b/lib/constants.nix
index 5df1f42..c9241c6 100644
--- a/lib/constants.nix
+++ b/lib/constants.nix
@@ -102,9 +102,11 @@ rec {
     cache = rec {
       substituters = [
         "https://nix-cache.${pubDomain}"
+        "https://cache.numtide.com"
       ];
       keys = [
         "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+        "niks3.numtide.com-1:DTx8wZduET09hRmMtKdQDxNNthLQETkc/yaX7M4qK0g="
       ];
       conf = ''
         extra-substituters = ${concatStringsSep " " substituters}