diff --git a/.github/workflows/vulnix.yml b/.github/workflows/vulnix.yml
index 13a5440..60f797c 100644
--- a/.github/workflows/vulnix.yml
+++ b/.github/workflows/vulnix.yml
@@ -25,7 +25,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
-        run: nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"
+        run: 'nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"'
 
       - name: close resolved issue
         if: steps.scan.outputs.count == '0'
diff --git a/ci.nix b/ci.nix
index 2a6d0d1..77fa121 100644
--- a/ci.nix
+++ b/ci.nix
@@ -1,10 +1,17 @@
 { lib, pkgs }:
+let
+  # vulnix's bundled nix-2.34 broke its own --experimental-features detection
+  nixConf = pkgs.writeText "ci-nix.conf" "experimental-features = nix-command flakes";
+in
 # tools must track ci.py's subprocess calls; nix stays ambient (uses the
 # runner's own nix, not a pinned one).
 pkgs.writers.writePython3Bin "ci" {
   flakeIgnore = [ "E501" ];
   libraries = [ pkgs.python3Packages.subprocess-tee ];
   makeWrapperArgs = [
+    "--set-default"
+    "NIX_USER_CONF_FILES"
+    (toString nixConf)
     "--prefix"
     "PATH"
     ":"
diff --git a/ci.py b/ci.py
index b83f958..86eafef 100644
--- a/ci.py
+++ b/ci.py
@@ -18,7 +18,8 @@ def run(*args, **kw):
 
 
 def nix(*args):
-    return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True).stdout
+    # tee to stderr - stdout leaks into GITHUB_OUTPUT $() captures
+    return subprocess_tee.run(("nix", "--extra-experimental-features", "nix-command flakes", "-L", *args), check=True, text=True, stdout=sys.stderr).stdout
 
 
 def git(*args, check=True):
diff --git a/containers/server-n0/git.nix b/containers/server-n0/git.nix
index 07786df..b7ac5ce 100644
--- a/containers/server-n0/git.nix
+++ b/containers/server-n0/git.nix
@@ -163,10 +163,9 @@ in
             trusted-public-keys = [ "microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys=" ];
           };
 
-          nix.gc = {
-            automatic = true;
-            dates = "daily";
-            options = "--delete-older-than 14d";
+          nix.settings = {
+            min-free = 5 * 1024 * 1024 * 1024;
+            max-free = 10 * 1024 * 1024 * 1024;
           };
           # nix.optimise.automatic = true; - doesn't work with microvm.writableStoreOverlay