diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6d06b3f..00de93a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,30 +1,43 @@
-name: 'build'
+name: build
+
 on:
   pull_request:
   push:
+
 jobs:
   build:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+
     steps:
-      - name: 'Checkout codebase'
-        if: github.event_name == 'push'
-        uses: actions/checkout@v2.4.0
+      - name: Checkout (push/merge)
+        if: ${{ github.event_name != 'pull_request' }}
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
-      - name: 'Checkout codebase'
-        if: github.event_name == 'pull_request'
-        uses: actions/checkout@v2.4.0
+      - name: Checkout (PR head)
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: cachix/install-nix-action@v14
-      - run: NIXPKGS_ALLOW_UNFREE=1 nix --experimental-features 'nix-command flakes' build -L --impure
-      - name: 'Copy book'
-        run: cp result/share/book.pdf .
-      - name: 'Upload artifact to GitHub'
-        uses: actions/upload-artifact@v2.2.4
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Build (Nix flake)
+        run: nix build -L --impure
+        env:
+          NIXPKGS_ALLOW_UNFREE: 1
+
+      - name: Copy book
+        run: cp result/share/book.pdf ./book.pdf
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
         with:
           name: book.pdf
           path: book.pdf
+          if-no-files-found: error
+          retention-days: 90
diff --git a/flake.lock b/flake.lock
index ee12896..9f61ff6 100644
--- a/flake.lock
+++ b/flake.lock
@@ -3,11 +3,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1627913399,
-        "narHash": "sha256-hY8g6H2KFL8ownSiFeMOjwPC8P0ueXpCVEbxgda3pko=",
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "12c64ca55c1014cdc1b16ed5a804aa8576601ff2",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -18,11 +18,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1640233012,
-        "narHash": "sha256-DNKMmWZ/RLoh5IVJLAa5HYOy4IW28mBBYDMgMxzzom8=",
+        "lastModified": 1757347588,
+        "narHash": "sha256-tLdkkC6XnsY9EOZW9TlpesTclELy8W7lL2ClL+nma8o=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "611f29bedadfb2aa4c9c26c4af65f05dd35f2f3f",
+        "rev": "b599843bad24621dcaa5ab60dac98f9b0eb1cabe",
         "type": "github"
       },
       "original": {
@@ -39,13 +39,31 @@
         "utils": "utils"
       }
     },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1638122382,
-        "narHash": "sha256-sQzZzAbvKEqN9s0bzWuYmRaA03v40gaJ4+iL1LXjaeI=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "74f7e4319258e287b0f9cb95426c9853b282730b",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {