diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 92df03c3..e7487807 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ on:
 
 jobs:
   build:
-    if: ${{ always() }}
+    if: ${{ false }}
     runs-on: ubuntu-latest
     container:
       image: docker.io/zmkfirmware/zmk-build-arm:3.0
@@ -104,7 +104,7 @@ jobs:
               throw new Error('Failed to build one or more configurations');
             }
   compile-matrix:
-    if: ${{ always() }}
+    if: ${{ false && always() }}
     runs-on: ubuntu-latest
     needs: [core-coverage, board-changes, nightly]
     outputs:
@@ -144,7 +144,7 @@ jobs:
               shieldArgs: JSON.stringify(shieldArgs),
             }));
   core-coverage:
-    if: ${{ needs.get-changed-files.outputs.core-changes == 'true' }}
+    if: ${{ false && needs.get-changed-files.outputs.core-changes == 'true' }}
     runs-on: ubuntu-latest
     needs: get-changed-files
     outputs:
@@ -173,7 +173,7 @@ jobs:
 
             return [...include, ...coreCoverage.include];
   board-changes:
-    if: ${{ needs.get-changed-files.outputs.board-changes == 'true' }}
+    if: ${{ false && needs.get-changed-files.outputs.board-changes == 'true' }}
     runs-on: ubuntu-latest
     needs: [get-grouped-hardware, get-changed-files]
     outputs:
@@ -257,7 +257,7 @@ jobs:
               });
             }))).flat();
   nightly:
-    if: ${{ github.event_name == 'schedule' }}
+    if: ${{ false && github.event_name == 'schedule' }}
     runs-on: ubuntu-latest
     needs: get-grouped-hardware
     outputs:
@@ -302,6 +302,7 @@ jobs:
 
             return [...includeOnboard, ...includeInterconnect];
   get-grouped-hardware:
+    if: ${{ false }}
     runs-on: ubuntu-latest
     outputs:
       organized-metadata: ${{ steps.organize-metadata.outputs.result }}
@@ -379,7 +380,7 @@ jobs:
             return JSON.stringify(grouped).replace(/\\/g,"\\\\");
           result-encoding: string
   get-changed-files:
-    if: ${{ github.event_name != 'schedule' }}
+    if: ${{ false && github.event_name != 'schedule' }}
     runs-on: ubuntu-latest
     outputs:
       changed-files: ${{ steps.changed-files.outputs.all }}
diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
new file mode 100644
index 00000000..82a9da47
--- /dev/null
+++ b/.github/workflows/nix-build.yml
@@ -0,0 +1,62 @@
+name: Build
+
+on:
+  push:
+    paths:
+      - ".github/workflows/nix-build.yml"
+      - "default.nix"
+      - "app/**"
+      - "nix/**"
+    branches:
+      - '**'
+    tags:
+      - '**'
+  pull_request:
+    paths:
+      - ".github/workflows/nix-build.yml"
+      - "default.nix"
+      - "app/**"
+      - "nix/**"
+
+jobs:
+  build:
+    name: Build Glove80 Firmware
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2.4.0
+      - uses: cachix/install-nix-action@v16
+        with:
+          nix_path: nixpkgs=channel:nixos-22.05
+      - uses: cachix/cachix-action@v12
+        with:
+          name: moergo-glove80-zmk-dev
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          skipPush: "${{ github.repository != 'moergo-sc/zmk' }}"
+      - name: Build Glove80 combined firmware
+        run: nix-build -A glove80_combined -o combined
+      - name: Copy result out of nix store
+        run: cp combined/glove80.uf2 glove80.uf2
+      - name: Upload result
+        uses: actions/upload-artifact@v3
+        with:
+          name: glove80.uf2
+          path: glove80.uf2
+  release:
+    name: Create Release for Tag
+    if: >-
+      github.repository == 'moergo-sc/zmk'
+      && github.event_name == 'push'
+      && contains(github.ref, 'refs/tags/v')
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download compiled firmware artifact
+        uses: actions/download-artifact@v3
+        with:
+          name: glove80.uf2
+      - name: Create Release for Tag
+        uses: ncipollo/release-action@v1
+        with:
+          artifacts: "glove80.uf2"
+          artifactErrorsFailBuild: true
+          generateReleaseNotes: true
diff --git a/default.nix b/default.nix
index 0e83e178..e1b25bdc 100644
--- a/default.nix
+++ b/default.nix
@@ -1,4 +1,4 @@
-{ pkgs ?  import <nixpkgs> {} }:
+{ pkgs ? (import ./nix/pinned-nixpkgs.nix {}) }:
 let
   inherit (pkgs) newScope;
   inherit (pkgs.lib) makeScope;
diff --git a/nix/cmake-shell.nix b/nix/cmake-shell.nix
index 14754d41..de68e6cf 100644
--- a/nix/cmake-shell.nix
+++ b/nix/cmake-shell.nix
@@ -1,4 +1,4 @@
-{ pkgs ? (import <nixpkgs> {})}:
+{ pkgs ? (import ./pinned-nixpkgs.nix {}) }:
 
 let
   zmkPkgs = (import ../default.nix { inherit pkgs; });
diff --git a/nix/generate-pin.rb b/nix/generate-pin.rb
new file mode 100755
index 00000000..b6bf682d
--- /dev/null
+++ b/nix/generate-pin.rb
@@ -0,0 +1,34 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require 'json'
+require 'net/http'
+require 'shellwords'
+
+def get_channel_url(channel)
+  uri = URI("https://channels.nixos.org/#{channel}")
+  res = Net::HTTP.get_response(uri)
+  raise 'Not a redirect' unless res.is_a?(Net::HTTPRedirection)
+  res['location']
+end
+
+def fetch_tarball(url)
+  hash = `nix-prefetch-url --unpack #{Shellwords.escape(url)}`
+  raise 'Prefetch failed' unless $?.success?
+  hash.chomp
+end
+
+def generate_pin(channel)
+  channel_url = get_channel_url(channel)
+  nixexprs = "#{channel_url}/nixexprs.tar.xz"
+  hash = fetch_tarball(nixexprs)
+  { url: nixexprs, sha256: hash }
+end
+
+def main
+  channel = ENV.fetch('CHANNEL', 'nixpkgs-unstable')
+  pin = generate_pin(channel)
+  puts JSON.pretty_generate(pin)
+end
+
+main
diff --git a/nix/pinned-nixpkgs.json b/nix/pinned-nixpkgs.json
new file mode 100644
index 00000000..b694f166
--- /dev/null
+++ b/nix/pinned-nixpkgs.json
@@ -0,0 +1,4 @@
+{
+  "url": "https://releases.nixos.org/nixpkgs/22.05-darwin/nixpkgs-darwin-22.05pre383202.058d97782ed/nixexprs.tar.xz",
+  "sha256": "0m00195y7l2b3mrzi26ljm32s24qp5paz15fqbd49iyfjzxv7xb8"
+}
diff --git a/nix/pinned-nixpkgs.nix b/nix/pinned-nixpkgs.nix
new file mode 100644
index 00000000..c62cf91d
--- /dev/null
+++ b/nix/pinned-nixpkgs.nix
@@ -0,0 +1,17 @@
+{ system ? builtins.currentSystem }:
+
+let
+  pin = builtins.fromJSON (builtins.readFile ./pinned-nixpkgs.json);
+
+  nixpkgsSrc = builtins.fetchTarball {
+     inherit (pin) url sha256;
+  };
+in
+
+import nixpkgsSrc {
+  inherit system;
+  config = {
+    allowUnfree = true;
+  };
+  overlays = []; # prevent impure overlays
+}
diff --git a/nix/west-shell.nix b/nix/west-shell.nix
index 3ecfe764..390fc491 100644
--- a/nix/west-shell.nix
+++ b/nix/west-shell.nix
@@ -1,4 +1,4 @@
-{ pkgs ? (import <nixpkgs> {})}:
+{ pkgs ? (import ./pinned-nixpkgs.nix {}) }:
 
 let
   # need a newer west than nixpkgs packages
@@ -28,10 +28,15 @@ let
     intelhex
     west
   ];
+
+  requiredStdenv =
+    if pkgs.stdenv.hostPlatform.isLinux
+    then pkgs.multiStdenv
+    else pkgs.stdenv;
 in
 with pkgs;
 # requires multiStdenv to build 32-bit test binaries
-multiStdenv.mkDerivation {
+requiredStdenv.mkDerivation {
   name = "zmk-shell";
 
   buildInputs = [