diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
deleted file mode 100644
index 5ed48d9..0000000
--- a/.github/workflows/ci.yml
+++ /dev/null
@@ -1,243 +0,0 @@
-# The matrix feature is overused because it lets us do globals and interpolation
-# in more places (where we're for some reason forbidden from using workflow
-# environment variables).
-#
-# TODO
-#
-#   * Uploading executables by running `cabal install`, because that saves them
-#     to a known place. Not ideal, and we guess that "known" place.
-#   * `cabal build` and `cabal install` have bugs and inconsistencies, stripping
-#     may not work, our flags might get thrown away between `cabal` calls.
-
-name: CI
-
-on:
-  push:
-    branches:
-    - main
-  pull_request:
-    types:
-    - synchronize
-    - opened
-    - reopened
-
-# If env.exe exists, jobs will build and upload the specified executable with
-# optimizations (-O2). If it doesn't exist, jobs will build without
-# optimizations (-O0).
-#env:
-#  exe: bytepatch
-
-jobs:
-
-  ubuntu-cabal-test:
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.os }} / test / GHC ${{ matrix.ghc }}, Cabal
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-latest]
-        cabal: [latest]
-        ghc:
-        - 9.2.2
-        include:
-        - ghc: 9.2.2
-          build: release
-
-    steps:
-
-    # TODO: GHC decides to recompile based on timestamp, so cache isn't used
-    # Preferably GHC would work via hashes instead. Stack had this feature
-    # merged in Aug 2020.
-    # Upstream GHC issue: https://gitlab.haskell.org/ghc/ghc/-/issues/16495
-    # My issue on haskell/actions: https://github.com/haskell/actions/issues/41
-    # This also requires us to do a deep fetch, else we don't get the Git commit
-    # history we need to rewrite mod times.
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-    - name: Set all tracked file modification times to the time of their last commit
-      run: |
-        rev=HEAD
-        IFS=$'\n'
-        for f in $(git ls-tree -r -t --full-name --name-only "$rev") ; do
-            touch -d $(git log --pretty=format:%cI -1 "$rev" -- "$f") "$f";
-        done
-
-    - name: Setup Haskell build environment
-      id: setup-haskell-build-env
-      uses: haskell/actions/setup@v1
-      with:
-        ghc-version: ${{ matrix.ghc }}
-        cabal-version: ${{ matrix.cabal }}
-
-    - run: cabal freeze
-
-    - name: Cache Cabal build artifacts
-      uses: actions/cache@v2
-      with:
-        path: |
-          ${{ steps.setup-haskell-build-env.outputs.cabal-store }}
-          dist-newstyle
-        key:          test-cabal-build-artifacts-${{ runner.os }}-ghc_${{ matrix.ghc }}-${{ hashFiles('cabal.project.freeze') }}
-        restore-keys: test-cabal-build-artifacts-${{ runner.os }}-ghc_${{ matrix.ghc }}
-
-    - name: Build (exe)
-      if: "env.exe != 0 && matrix.build == 'release'"
-      run: cabal build -O2
-    - name: Build (skip exe)
-      if: "env.exe != 0 && matrix.build != 'release'"
-      run: cabal build -O0
-    - name: Build (no exe)
-      if: "env.exe == 0"
-      run: cabal build -O0
-
-    - name: Test
-      run: cabal test --test-show-details=streaming
-      env:
-        HSPEC_OPTIONS: --color
-
-    - name: Install
-      if: "env.exe != 0 && matrix.build == 'release'"
-      run: cabal install
-
-    # note that Cabal uses symlinks -- actions/upload-artifact@v2 apparently
-    # dereferences for us
-    - name: Upload executable
-      if: "env.exe != 0 && matrix.build == 'release'"
-      uses: actions/upload-artifact@v2
-      with:
-        path: ~/.cabal/bin/${{ env.exe }}
-        name: ${{ env.exe }}-${{ runner.os }}-ghc_${{ matrix.ghc }}-cabal-${{ github.sha }}
-        if-no-files-found: error
-
-  mac-cabal-test:
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.os }} / test / GHC ${{ matrix.ghc }}, Cabal
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest]
-        cabal: [latest]
-        ghc:
-        - 9.2.2
-        include:
-        - ghc: 9.2.2
-          build: release
-
-    steps:
-
-    # TODO figure out timestamp fixer on Mac (no Mac available to test)
-    - uses: actions/checkout@v2
-
-    - name: Setup Haskell build environment
-      id: setup-haskell-build-env
-      uses: haskell/actions/setup@v1
-      with:
-        ghc-version: ${{ matrix.ghc }}
-        cabal-version: ${{ matrix.cabal }}
-
-    - run: cabal freeze
-
-    - name: Cache Cabal build artifacts
-      uses: actions/cache@v2
-      with:
-        path: |
-          ${{ steps.setup-haskell-build-env.outputs.cabal-store }}
-          dist-newstyle
-        key:          test-cabal-build-artifacts-${{ runner.os }}-ghc_${{ matrix.ghc }}-${{ hashFiles('cabal.project.freeze') }}
-        restore-keys: test-cabal-build-artifacts-${{ runner.os }}-ghc_${{ matrix.ghc }}
-
-    - name: Build (exe)
-      if: "env.exe != 0 && matrix.build == 'release'"
-      run: cabal build -O2
-    - name: Build (skip exe)
-      if: "env.exe != 0 && matrix.build != 'release'"
-      run: cabal build -O0
-    - name: Build (no exe)
-      if: "env.exe == 0"
-      run: cabal build -O0
-
-    - name: Test
-      run: cabal test --test-show-details=streaming
-      env:
-        HSPEC_OPTIONS: --color
-
-    - name: Install
-      if: "env.exe != 0 && matrix.build == 'release'"
-      run: cabal install
-
-    # note that Cabal uses symlinks -- actions/upload-artifact@v2 apparently
-    # dereferences for us
-    - name: Upload executable
-      if: "env.exe != 0 && matrix.build == 'release'"
-      uses: actions/upload-artifact@v2
-      with:
-        path: ~/.cabal/bin/${{ env.exe }}
-        name: ${{ env.exe }}-${{ runner.os }}-ghc_${{ matrix.ghc }}-cabal-${{ github.sha }}
-        if-no-files-found: error
-
-  windows-cabal-test:
-    runs-on: ${{ matrix.os }}
-    name: ${{ matrix.os }} / test / GHC ${{ matrix.ghc }}, Cabal
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [windows-latest]
-        cabal: [latest]
-        ghc:
-        - 9.2.2
-        include:
-        - ghc: 9.2.2
-          build: release
-
-    steps:
-
-    # TODO can't do cache fixer on Windows b/c it's a Bash script...
-    - uses: actions/checkout@v2
-
-    - name: Setup Haskell build environment
-      id: setup-haskell-build-env
-      uses: haskell/actions/setup@v1
-      with:
-        ghc-version: ${{ matrix.ghc }}
-        cabal-version: ${{ matrix.cabal }}
-
-    - run: cabal freeze
-
-    - name: Cache Cabal build artifacts
-      uses: actions/cache@v2
-      with:
-        path: |
-          ${{ steps.setup-haskell-build-env.outputs.cabal-store }}
-          dist-newstyle
-        key:          test-cabal-build-artifacts-${{ runner.os }}-ghc_${{ matrix.ghc }}-${{ hashFiles('cabal.project.freeze') }}
-        restore-keys: test-cabal-build-artifacts-${{ runner.os }}-ghc_${{ matrix.ghc }}
-
-    - name: Build (exe)
-      if: "env.exe != 0 && matrix.build == 'release'"
-      run: cabal build -O2
-    - name: Build (skip exe)
-      if: "env.exe != 0 && matrix.build != 'release'"
-      run: cabal build -O0
-    - name: Build (no exe)
-      if: "env.exe == 0"
-      run: cabal build -O0
-
-    - name: Test
-      run: cabal test --test-show-details=streaming
-      env:
-        HSPEC_OPTIONS: --color
-
-    - name: Install
-      if: "env.exe != 0 && matrix.build == 'release'"
-      run: cabal install
-
-    # note that Cabal uses symlinks -- actions/upload-artifact@v2 apparently
-    # dereferences for us
-    - name: Upload executable
-      if: "env.exe != 0 && matrix.build == 'release'"
-      uses: actions/upload-artifact@v2
-      with:
-        path: C:/cabal/bin/${{ env.exe }}.exe
-        name: ${{ env.exe }}-${{ runner.os }}-ghc_${{ matrix.ghc }}-cabal-${{ github.sha }}
-        if-no-files-found: error
diff --git a/.github/workflows/hackage.yml b/.github/workflows/hackage.yml
deleted file mode 100644
index 0e888ba..0000000
--- a/.github/workflows/hackage.yml
+++ /dev/null
@@ -1,100 +0,0 @@
-# GitHub Actions worflow to build Hackage artifacts for a project: an sdist
-# archive, and Haddock docs for uploading to Hackage.
-#
-# I would love to do this in the same testing workflows, so we're not wasting
-# GitHub's resources, but workflow syntax is debilitating and they strip docs in
-# their provided GHCs, so there's too much complexity to handle it in one place.
-#
-# This workflow is based on the expectation that GitHub's runners install GHC
-# using ghcup with default settings (installs GHCs to `~/.ghcup/ghc/$VERSION`).
-
-name: Hackage artifacts
-
-on:
-  push:
-    branches:
-    - main
-
-env:
-  # ghcup needs full version string (e.g. 9.0.1, not 9.0)
-  ghc: "9.2.2"
-  package_name: strongweak
-
-jobs:
-  hackage:
-    runs-on: ubuntu-latest
-    name: Hackage artifacts
-
-    steps:
-
-    # TODO: GHC decides to recompile based on timestamp, so cache isn't used
-    # Preferably GHC would work via hashes instead. Stack had this feature
-    # merged in Aug 2020.
-    # Upstream GHC issue: https://gitlab.haskell.org/ghc/ghc/-/issues/16495
-    # My issue on haskell/actions: https://github.com/haskell/actions/issues/41
-    # This also requires us to do a deep fetch, else we don't get the Git commit
-    # history we need to rewrite mod times.
-    - uses: actions/checkout@v2
-      with:
-        fetch-depth: 0
-    - name: Set all tracked file modification times to the time of their last commit
-      run: |
-        rev=HEAD
-        for f in $(git ls-tree -r -t --full-name --name-only "$rev") ; do
-            touch -d $(git log --pretty=format:%cI -1 "$rev" -- "$f") "$f";
-        done
-
-    - name: Delete preinstalled docs-stripped GHC ${{ env.ghc }}
-      run: rm -rf $HOME/.ghcup/ghc/${{ env.ghc }}
-
-    - name: Cache GHC ${{ env.ghc }}
-      uses: actions/cache@v2
-      with:
-        path: ~/.ghcup/ghc/${{ env.ghc }}
-        key: hackage-ghc-${{ runner.os }}-ghc_${{ env.ghc }}
-
-    - name: Install GHC ${{ env.ghc }} if not present from cache
-      run: |
-        if [ ! -d $HOME/.ghcup/ghc/${{ env.ghc }} ]; then
-            ghcup install ghc --force ${{ env.ghc }}
-        fi
-
-    - run: ghcup set ghc ${{ env.ghc }}
-
-    - run: cabal update
-
-    - run: cabal freeze
-
-    - name: Cache Cabal build artifacts
-      uses: actions/cache@v2
-      with:
-        path: |
-          ~/.cabal/store
-          dist-newstyle
-        key:          hackage-deps-${{ runner.os }}-ghc_${{ env.ghc }}-${{ hashFiles('cabal.project.freeze') }}
-        restore-keys: hackage-deps-${{ runner.os }}-ghc_${{ env.ghc }}
-
-    # TODO 2022-04-22: --haddock-options=--quickjump fixes a bug with not
-    # propagating --haddock-quickjump to building dependency Haddocks
-    - run: cabal build --enable-documentation --haddock-for-hackage --haddock-options=--quickjump
-
-    - run: cabal sdist
-
-    - name: Upload Hackage sdist
-      uses: actions/upload-artifact@v2
-      with:
-        path: dist-newstyle/sdist/${{ env.package_name }}-*.tar.gz
-        name: ${{ env.package_name }}-sdist-${{ github.sha }}.tar.gz
-        if-no-files-found: error
-
-    - name: Upload Hackage Haddock docs
-      uses: actions/upload-artifact@v2
-      with:
-        path: dist-newstyle/${{ env.package_name }}-*-docs.tar.gz
-        name: ${{ env.package_name }}-hackage-haddocks-${{ github.sha }}.tar.gz
-        if-no-files-found: error
-
-    - name: Delete prepared tarballs (else can't extract just newest next time)
-      run: |
-        rm dist-newstyle/${{ env.package_name }}-*-docs.tar.gz
-        rm dist-newstyle/sdist/${{ env.package_name }}-*.tar.gz
diff --git a/.github/workflows/nix.yaml b/.github/workflows/nix.yaml
new file mode 100644
index 0000000..07b80bf
--- /dev/null
+++ b/.github/workflows/nix.yaml
@@ -0,0 +1,22 @@
+name: Nix
+
+on:
+  push:
+
+jobs:
+  nix-build:
+    name: nix build .#${{ matrix.ghc }}-strongweak
+    strategy:
+      fail-fast: false
+      matrix:
+        ghc: [ghc98, ghc910]
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: "write"
+      contents: "read"
+    steps:
+    - uses: actions/checkout@v4
+    - uses: DeterminateSystems/nix-installer-action@main
+    - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: DeterminateSystems/flake-checker-action@main
+    - run: nix build .#${{ matrix.ghc }}-strongweak
diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
deleted file mode 100644
index 956721a..0000000
--- a/.github/workflows/nix.yml
+++ /dev/null
@@ -1,21 +0,0 @@
-name: nix
-
-on:
-  # run on every push to every branch (visibility doesn't matter)
-  push:
-  # don't want pull_request config, since it would run twice
-
-jobs:
-  nix-flake-build:
-    runs-on: ubuntu-latest
-    name: build (flake)
-    steps:
-    - uses: actions/checkout@v3
-    - uses: cachix/install-nix-action@v20
-      with:
-        nix_path: nixpkgs=channel:nixos-unstable
-    - uses: cachix/cachix-action@v12
-      with:
-        name: raehik
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-    - run: nix build