diff --git a/.github/actions/nix-cachix-setup/action.yml b/.github/actions/nix-cachix-setup/action.yml
index 860cb26..09ae09e 100644
--- a/.github/actions/nix-cachix-setup/action.yml
+++ b/.github/actions/nix-cachix-setup/action.yml
@@ -49,6 +49,10 @@ runs:
         nix_conf: |
           keep-env-derivations = true
           keep-outputs = true
+          # Authenticate nix GitHub API calls (flake resolution) so they
+          # use the run token rate limit (~1000/hr) instead of the
+          # unauthenticated 60/hr/IP cap, which 429s under CI bursts.
+          access-tokens = github.com=${{ github.token }}
     # Substitute prebuilt rainix derivations from the shared Cachix binary
     # cache instead of rebuilding toolchain crates from source (rainix#196).
     # Pushes new paths when the auth token is set; continue-on-error so a