diff --git a/.github/workflows/diff-pr.yml b/.github/workflows/diff-pr.yml
index 4dd6bf9..17b0abf 100644
--- a/.github/workflows/diff-pr.yml
+++ b/.github/workflows/diff-pr.yml
@@ -24,10 +24,10 @@ jobs:
 
       - name: build closures and render diff
         run: |
-          nix run .#ci -- diff "$RUNNER_TEMP/base" . \
+          nix run -L .#ci -- diff "$RUNNER_TEMP/base" . \
             "### System closure diff vs \`${{ github.event.pull_request.base.ref }}\`" \
             > "$RUNNER_TEMP/comment.md"
-          nix run .#ci -- inspect-diff "$RUNNER_TEMP/base" . \
+          nix run -L .#ci -- inspect-diff "$RUNNER_TEMP/base" . \
             "### Inspection diff vs \`${{ github.event.pull_request.base.ref }}\`" \
             >> "$RUNNER_TEMP/comment.md"
 
@@ -37,4 +37,4 @@ jobs:
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
           PR: ${{ github.event.pull_request.number }}
-        run: nix run .#ci -- post-comment "<!-- dix-diff -->" "$RUNNER_TEMP/comment.md"
+        run: nix run -L .#ci -- post-comment "<!-- dix-diff -->" "$RUNNER_TEMP/comment.md"
diff --git a/.github/workflows/diff-tag.yml b/.github/workflows/diff-tag.yml
index d3bb30d..381814d 100644
--- a/.github/workflows/diff-tag.yml
+++ b/.github/workflows/diff-tag.yml
@@ -25,8 +25,8 @@ jobs:
           git worktree add "$RUNNER_TEMP/old" "$tag"
           head=$(git rev-parse --short HEAD)
           {
-            nix run .#ci -- diff "$RUNNER_TEMP/old" . \
+            nix run -L .#ci -- diff "$RUNNER_TEMP/old" . \
               "# System closure diff: \`$tag\` -> \`$head\`"
-            nix run .#ci -- inspect-diff "$RUNNER_TEMP/old" . \
+            nix run -L .#ci -- inspect-diff "$RUNNER_TEMP/old" . \
               "# Inspection diff: \`$tag\` -> \`$head\`"
           } | tee -a "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml
index 3a475dd..27ec96d 100644
--- a/.github/workflows/flake-update.yml
+++ b/.github/workflows/flake-update.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - run: nix flake update
+      - run: nix flake update -L
 
       - name: open/update PR
         env:
@@ -24,5 +24,5 @@ jobs:
           REPO: ${{ github.repository }}
         run: |
           printf 'Automated `nix flake update`.\n' > "$RUNNER_TEMP/body.md"
-          nix run .#ci -- open-pr \
+          nix run -L .#ci -- open-pr \
             flake-update "$GITHUB_REF_NAME" "flake.lock: update inputs" "$RUNNER_TEMP/body.md" automated
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 41517aa..bb0b54c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -28,9 +28,9 @@ jobs:
           fi
 
       - name: run linters
-        run: nix run .#ci -- lint . "$RUNNER_TEMP/findings"
+        run: nix run -L .#ci -- lint . "$RUNNER_TEMP/findings"
 
       - name: report findings
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: nix run .#ci -- lint-report "$REPORTER" "$RUNNER_TEMP/findings"
+        run: nix run -L .#ci -- lint-report "$REPORTER" "$RUNNER_TEMP/findings"
diff --git a/.github/workflows/vulnix.yml b/.github/workflows/vulnix.yml
index 220bc1c..13a5440 100644
--- a/.github/workflows/vulnix.yml
+++ b/.github/workflows/vulnix.yml
@@ -17,7 +17,7 @@ jobs:
 
       - name: scan host closures
         id: scan
-        run: echo "count=$(nix run .#ci -- vulnix . "$RUNNER_TEMP/issue.md")" >> "$GITHUB_OUTPUT"
+        run: echo "count=$(nix run -L .#ci -- vulnix . "$RUNNER_TEMP/issue.md")" >> "$GITHUB_OUTPUT"
 
       - name: file/update issue
         if: steps.scan.outputs.count != '0'
@@ -25,7 +25,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
-        run: nix run .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"
+        run: nix run -L .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"
 
       - name: close resolved issue
         if: steps.scan.outputs.count == '0'
@@ -33,4 +33,4 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           API: ${{ github.api_url }}
           REPO: ${{ github.repository }}
-        run: nix run .#ci -- close-issue vulnix
+        run: nix run -L .#ci -- close-issue vulnix