diff --git a/.github/workflows/csharp.yml b/.github/workflows/csharp.yml
index b4c1817a2..b1f2d7b3b 100644
--- a/.github/workflows/csharp.yml
+++ b/.github/workflows/csharp.yml
@@ -8,6 +8,10 @@ on:
   pull_request:
     paths:
       - payjoin-ffi/**
+      # The unix jobs run inside the flake's csharp dev shell, so changes to
+      # the flake change this workflow's environment.
+      - flake.nix
+      - flake.lock
 
 jobs:
   build-csharp-and-test-unix:
diff --git a/.github/workflows/dart.yml b/.github/workflows/dart.yml
index 801f726cc..115af707b 100644
--- a/.github/workflows/dart.yml
+++ b/.github/workflows/dart.yml
@@ -8,6 +8,10 @@ on:
   pull_request:
     paths:
       - payjoin-ffi/**
+      # The jobs run inside the flake's dev shell, so changes to the flake
+      # change this workflow's environment.
+      - flake.nix
+      - flake.lock
 
 jobs:
   build-dart-and-test:
diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml
index 28c46fc1a..c116525ca 100644
--- a/.github/workflows/javascript.yml
+++ b/.github/workflows/javascript.yml
@@ -8,6 +8,10 @@ on:
   pull_request:
     paths:
       - payjoin-ffi/**
+      # The jobs run inside the flake's dev shell, so changes to the flake
+      # change this workflow's environment.
+      - flake.nix
+      - flake.lock
 
 jobs:
   build-js-and-test:
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index b44cfc8f1..f66644b9a 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -8,6 +8,10 @@ on:
   pull_request:
     paths:
       - payjoin-ffi/**
+      # The jobs run inside the flake's dev shell, so changes to the flake
+      # change this workflow's environment.
+      - flake.nix
+      - flake.lock
 
 jobs:
   build-python-and-test:
diff --git a/flake.nix b/flake.nix
index 7cdf44c5e..6afbfdf41 100644
--- a/flake.nix
+++ b/flake.nix
@@ -259,7 +259,16 @@
             "payjoin-mailroom-image" = mkContainerImage "payjoin-mailroom" packages.payjoin-mailroom tag;
           };
 
-        dotnetSdk = pkgs.dotnetCorePackages.sdk_10_0;
+        # On Darwin the default sdk_10_0 resolves to the source-built VMR, which has
+        # no binaries in the public nix cache: every uncached realization compiles
+        # the entire .NET SDK from source (hours on CI runners and contributor
+        # machines). Use the Microsoft-binary SDK there; Linux keeps the
+        # source-built SDK, which hydra serves from cache.
+        dotnetSdk =
+          if pkgs.stdenv.isDarwin then
+            pkgs.dotnetCorePackages.sdk_10_0_1xx-bin
+          else
+            pkgs.dotnetCorePackages.sdk_10_0;
 
         devShells = builtins.mapAttrs (
           _name: craneLib: