diff --git a/infra/sectracker.nix b/infra/sectracker.nix
index c5a51d8d..415e39bf 100644
--- a/infra/sectracker.nix
+++ b/infra/sectracker.nix
@@ -89,4 +89,6 @@ in
     gh-app-private-key.file = ./secrets/nixpkgs-security-tracker.2024-12-09.private-key.pem.age;
     gh-app-installation-id.file = ./secrets/gh-app-installation-id.age;
   };
+
+  nix.optimise.automatic = true;
 }