diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index 0f7f7232..3a484d01 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -5,14 +5,14 @@ env:
     DEV_SHELL_NAME: CI
 jobs:
   build:
-    runs-on: nix-node
+    runs-on: nix-flakes
 
     steps:
-    - uses: actions/checkout@v3
     - uses: https://github.com/workflow/nix-shell-action@v3
       with:
         flakes: .#devShells.x86_64-linux.default
         script: |
+          git pull
           nix flake metadata
           nix --no-sandbox develop -c statix check
           nix flake check
diff --git a/nixos/boxes/bolty/gitea-runner-token.sops b/nixos/boxes/bolty/gitea-runner-token.sops
index c6af6819..878f1281 100644
--- a/nixos/boxes/bolty/gitea-runner-token.sops
+++ b/nixos/boxes/bolty/gitea-runner-token.sops
@@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:xTGgkaCxOBdMx/Q7zCTmcytr3IMzfDOqU8JrrkU8I78SljRGEPNz7LdDzv52PlfpUg==,iv:1gRhRf+qaQkUAh1zdvkRdjoi8wm6fRZbfMqU3DWS0pg=,tag:jHSqGOUPKtHTVGJujmOUzA==,type:str]",
+	"data": "ENC[AES256_GCM,data:kffo3XlbQbxewS4k/riSb0ZI8LHBJB+yAKRBFfVcu2F+WEA/RH7ktKz5h8dVa38=,iv:sNZ9DvwxfuZ43jsPjeXiBu0K+q2sZQ1G0hpyrzljwrM=,tag:VdDwz+7AWq5g1RiIyTR6xg==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -47,8 +47,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRTXVwRzVSd2NSSi90SVVu\na05jeitPNnE5TVJ1NXk5WGd6UnhObUwveHg0CjU0dTNxUUdtb253ZHdTMFkycWdI\nbjZsanUwSGdHcFZkckIrRDRTWldha3cKLS0tIE8wM09WMnhNeklnYytUWkVTc01E\neldXYlJXRm1OMWo0T1U3UlY4SFBndVEKs56uk3j02g1g7Ae16UGfwRQJghPvS8iG\nDcIrJp6tb5ToYKeAGcTDpDvaQeNWKBX6fSLVIiJbgDWIbbZp1HRYpw==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2023-06-03T10:42:06Z",
-		"mac": "ENC[AES256_GCM,data:EWNq6e7MwoCVf+67ABItZLonhtXCi+/2MHx5tq0F/Ub2My4VyRusEnQIoEGAJNn+vxo8Nd+ZY1EdPEZWqvGe/fmg5aWenoVJzdZHecock37PfZ4se0txSj35EqUFBtOjN5UfP++5HzVXBBXiNY/7HrhDIBScqH/YHCtlZyZR5OY=,iv:cT9IB83vY9iJsXCM0wX5hylaKXQWhqDeH0xtJoeVVng=,tag:pv5W+duzFzY7zV9XhbaBfw==,type:str]",
+		"lastmodified": "2023-06-10T07:41:00Z",
+		"mac": "ENC[AES256_GCM,data:8nR7eWn7vU7Ng1DwFI+0THMRkD87et1KKuSVYwP7g6Bius/dNVGNjJOcUi76bPI4Eb0GLKDGFEL9jtZJLqWXYxufZUC3Jt/CHMERfrBXPywetljYf3NL3UmwXtBwltyu9RqnytybMDJu7tzogqIeUVJEut1PEAY9fH2vuFG7VjU=,iv:UKd2g58urL+qQ4Z+rL/bFxfrIc5ZO3AqnAhV9WZuHwc=,tag:yCKS/jpT5g3gnbaaZRuUUw==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.7.3"
diff --git a/nixos/boxes/bolty/gitea-runner.nix b/nixos/boxes/bolty/gitea-runner.nix
index 8c158128..a366d654 100644
--- a/nixos/boxes/bolty/gitea-runner.nix
+++ b/nixos/boxes/bolty/gitea-runner.nix
@@ -13,7 +13,8 @@
     tokenFile = config.sops.secrets."gitea-runner-token".path;
     name = "bolty1";
     labels = [
-      "nix-node:docker://nixery.dev/shell/nix/git/nodejs:latest"
+      "nixery-nix-node:docker://nixery.dev/shell/nix/git/nodejs:latest"
+      "nix-flakes:docker://nixpkgs/nix-flakes:latest"
       "ubuntu-latest:docker://node:current-bullseye" # compat with github actions
     ];
   };