diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 4b5e566..cc85303 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -11,7 +11,17 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: cachix/install-nix-action@v23
+        with:
+          # Gitea will supply a token in GITHUB_TOKEN, which this action will
+          # try to pass to Nix when downloading from GitHub
+          github_access_token: ${{ secrets.GH_PULL_TOKEN }}
+          extra_nix_config: |
+            # Make sure we're using sandbox
+            sandbox-fallback = false
       - uses: DeterminateSystems/magic-nix-cache-action@main
+        env:
+          # Arch is amd64 in Gitea actions, this forms the download path for the cache
+          RUNNER_ARCH: X64
 
       - name: Write agenix secrets key to file
         env: