diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
index 75ff8aa..1b49b66 100644
--- a/.forgejo/workflows/ci.yaml
+++ b/.forgejo/workflows/ci.yaml
@@ -11,6 +11,9 @@ jobs:
   checks:
     name: checks (go test + golangci)
     runs-on: debian-stable
+    env:
+      # nixos/nix:latest does not enable flakes/experimental features by default.
+      NIX_CONFIG: experimental-features = nix-command flakes
     container:
       image: nixos/nix:latest
     steps:
@@ -29,6 +32,8 @@ jobs:
   build:
     name: build binaries + containers
     runs-on: debian-stable
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
     container:
       image: nixos/nix:latest
     steps:
@@ -47,6 +52,8 @@ jobs:
   format:
     name: format (gofmt + nixfmt)
     runs-on: debian-stable
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
     container:
       image: nixos/nix:latest
     steps:
@@ -81,6 +88,8 @@ jobs:
   integration:
     name: integration (live scrape + Typesense)
     runs-on: debian-stable
+    env:
+      NIX_CONFIG: experimental-features = nix-command flakes
     container:
       image: nixos/nix:latest
     services:
diff --git a/.forgejo/workflows/container.yaml b/.forgejo/workflows/container.yaml
index f7b8736..5071627 100644
--- a/.forgejo/workflows/container.yaml
+++ b/.forgejo/workflows/container.yaml
@@ -13,6 +13,9 @@ jobs:
       # Forgejo does not auto-expose secrets as env vars; map it explicitly
       # so the whole step (including the inner heredoc) can read it.
       REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+      # nixos/nix:latest does not enable flakes/experimental features by default;
+      # the heredoc steps run `nix build`/`nix develop` and need them.
+      NIX_CONFIG: experimental-features = nix-command flakes
     container:
       image: nixos/nix:latest
     steps: