diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7f642fc..cbc0cd9 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -22,9 +22,6 @@ on:
 permissions:
   contents: read
 
-env:
-  DAGGER_VERSION: "0.21.7"
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -38,18 +35,19 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
-      - name: Install Dagger
-        uses: dagger/dagger-for-github@v8.2.0
-        with:
-          version: ${{ env.DAGGER_VERSION }}
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Lint (cargo fmt --check + clippy)
-        run: dagger call lint
+        run: nix develop --command dagger call lint
         env:
           DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }}
 
       - name: Test (cargo test --workspace)
-        run: dagger call test
+        run: nix develop --command dagger call test
         env:
           DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }}
 
@@ -142,14 +140,16 @@ jobs:
       # them, which is what makes a downloaded CI artifact identifiable. The
       # commit has to be passed in because the Dagger module builds from a
       # source directory with no `.git` in it.
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
+
       - name: Cross-compile all targets via Dagger
-        uses: dagger/dagger-for-github@v8.2.0
         env:
           DAGGER_CLOUD_TOKEN: ${{ secrets.DAGGER_CLOUD_TOKEN }}
-        with:
-          verb: call
-          args: build --commit=${{ github.sha }} export --path=./build
-          version: ${{ env.DAGGER_VERSION }}
+        run: nix develop --command dagger call build --commit=${{ github.sha }} export --path=./build
 
       - name: Upload darwin arm64 binary
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/cut-release.yaml b/.github/workflows/cut-release.yaml
index ca905a0..7ba534f 100644
--- a/.github/workflows/cut-release.yaml
+++ b/.github/workflows/cut-release.yaml
@@ -6,9 +6,6 @@ on:
 permissions:
   contents: write
 
-env:
-  DAGGER_VERSION: "0.21.7"
-
 jobs:
   create-release:
     name: Cut New GitHub Release
@@ -27,14 +24,15 @@ jobs:
           app-id: ${{ secrets.PAPER_COMPUTE_CO_BOT_APP_ID }}
           private-key: ${{ secrets.PAPER_COMPUTE_CO_BOT_PRIVATE_KEY }}
 
-      - name: Install Dagger
-        uses: dagger/dagger-for-github@v8.2.0
-        with:
-          version: ${{ env.DAGGER_VERSION }}
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Create release via ghrelease
         run: |
-          dagger call -m github.com/papercomputeco/daggerverse/ghrelease \
+          nix develop --command dagger call -m github.com/papercomputeco/daggerverse/ghrelease@45e997aec734ec4875ff57bebed2317e1bd49185 \
               --token=env://GH_TOKEN \
             with-repo \
               --repo="${{ github.repository }}" \
diff --git a/.github/workflows/nightly.yaml b/.github/workflows/nightly.yaml
index 6cee0e8..b9678ff 100644
--- a/.github/workflows/nightly.yaml
+++ b/.github/workflows/nightly.yaml
@@ -8,9 +8,6 @@ on:
 permissions:
   contents: write
 
-env:
-  DAGGER_VERSION: "0.21.7"
-
 jobs:
   check:
     runs-on: depot-ubuntu-24.04
@@ -52,10 +49,11 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - name: Install Dagger
-        uses: dagger/dagger-for-github@v8.2.0
-        with:
-          version: ${{ env.DAGGER_VERSION }}
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Move nightly tag up to HEAD
         run: |
@@ -74,7 +72,7 @@ jobs:
       # with nothing uploaded.
       - name: Build and upload nightly artifacts
         run: |
-          dagger call \
+          nix develop --command dagger call \
             nightly \
               --commit="${{ github.sha }}" \
               --endpoint=env://BUCKET_ENDPOINT \
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 22fbbc4..4116fb3 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -24,9 +24,6 @@ permissions:
   contents: read
   pull-requests: read
 
-env:
-  DAGGER_VERSION: "0.21.7"
-
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -54,16 +51,18 @@ jobs:
         if: github.event.pull_request.user.login != 'dependabot[bot]'
         uses: actions/checkout@v4
 
-      - name: Install Dagger
+      - name: Install Nix
+        if: github.event.pull_request.user.login != 'dependabot[bot]'
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
         if: github.event.pull_request.user.login != 'dependabot[bot]'
-        uses: dagger/dagger-for-github@v8.2.0
-        with:
-          version: ${{ env.DAGGER_VERSION }}
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Check PR title conformance
         if: github.event.pull_request.user.login != 'dependabot[bot]'
         run: |
-          dagger call -m github.com/papercomputeco/daggerverse/ghcontrib \
+          nix develop --command dagger call -m github.com/papercomputeco/daggerverse/ghcontrib@45e997aec734ec4875ff57bebed2317e1bd49185 \
               --token=env://GH_TOKEN \
               --repo="${{ github.repository }}" \
             check-pull-request \
@@ -115,20 +114,24 @@ jobs:
           github.event.pull_request.head.repo.full_name == github.repository
         uses: actions/checkout@v4
 
-      - name: Install Dagger
+      - name: Install Nix
+        if: >-
+          github.event.pull_request.user.login != 'dependabot[bot]' &&
+          github.event.pull_request.head.repo.full_name == github.repository
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
         if: >-
           github.event.pull_request.user.login != 'dependabot[bot]' &&
           github.event.pull_request.head.repo.full_name == github.repository
-        uses: dagger/dagger-for-github@v8.2.0
-        with:
-          version: ${{ env.DAGGER_VERSION }}
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
 
       - name: Check Linear magic word
         if: >-
           github.event.pull_request.user.login != 'dependabot[bot]' &&
           github.event.pull_request.head.repo.full_name == github.repository
         run: |
-          dagger call -m github.com/papercomputeco/daggerverse/ghcontrib \
+          nix develop --command dagger call -m github.com/papercomputeco/daggerverse/ghcontrib@45e997aec734ec4875ff57bebed2317e1bd49185 \
               --token=env://GH_TOKEN \
               --repo="${{ github.repository }}" \
             check-pull-request-linear-magic-word \
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d25e153..a70056f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,9 +4,6 @@ on:
   release:
     types: [published]
 
-env:
-  DAGGER_VERSION: "0.21.7"
-
 jobs:
   release:
     runs-on: depot-ubuntu-24.04
@@ -17,10 +14,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Dagger
-        uses: dagger/dagger-for-github@v8.2.0
-        with:
-          version: ${{ env.DAGGER_VERSION }}
+      - name: Install Nix
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+
+      - name: Cache Nix store
+        uses: DeterminateSystems/magic-nix-cache-action@908b263ff629f4cc17666315b7fd3ec127c6244d # v14
+
 
       # `--version` and `--commit` are what a released binary answers
       # `tapesctl version` with. They have to be passed in: the Dagger module
@@ -40,7 +39,7 @@ jobs:
       # release it just cut.
       - name: Build and upload release artifacts
         run: |
-          dagger call \
+          nix develop --command dagger call \
             release-latest \
               --version="${{ github.event.release.tag_name }}" \
               --commit="${{ github.sha }}" \
diff --git a/dagger.json b/dagger.json
index 4df6fbf..a84c40e 100644
--- a/dagger.json
+++ b/dagger.json
@@ -1,6 +1,6 @@
 {
   "name": "tapesctl",
-  "engineVersion": "v0.21.7",
+  "engineVersion": "v0.21.8",
   "sdk": {
     "source": "go"
   },
diff --git a/flake.lock b/flake.lock
index 3488cb6..e92b826 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781718180,
-        "narHash": "sha256-olV0eG2YQlocEIgYl/zoeXn9BYVog3oq13dwhQi3BXw=",
+        "lastModified": 1785344846,
+        "narHash": "sha256-E0v8IiF9sEWNw615Yae1RH8KtMuOOF+mcafu2m0kHyE=",
         "owner": "dagger",
         "repo": "nix",
-        "rev": "c93d69f685b8a58eaa767eaaf189b0ac6f4f741a",
+        "rev": "b35b2b5ab62ace3a3c1e779c497de1ad762a4aa1",
         "type": "github"
       },
       "original": {