From 99a8b072aeee9c57099d1e1c6c1bdf8c45792e04 Mon Sep 17 00:00:00 2001
From: Luke Curley <kixelated@gmail.com>
Date: Mon, 2 Nov 2026 23:04:17 -0800
Subject: [PATCH] ci: keep pull request checks read-only

Co-Authored-By: GPT-6.1 Sol <noreply@openai.com>
---
 .github/workflows/check.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 7f4218c..a0ba574 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -1,7 +1,6 @@
 name: Check
 
 permissions:
-  id-token: write
   contents: read
 
 on:
@@ -29,6 +28,9 @@ jobs:
         with:
           determinate: false
       - uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # main
+        with:
+          use-flakehub: disabled
+          use-gha-cache: enabled
 
       - name: Rust Cache
         uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2