diff --git a/.github/workflows/default.yml b/.github/workflows/default.yml
index b90b784..5ea7442 100644
--- a/.github/workflows/default.yml
+++ b/.github/workflows/default.yml
@@ -5,6 +5,10 @@ on: [ "push", "pull_request" ]
 env:
   CARGO_TERM_COLOR: always
 
+permissions:
+  id-token: "write"
+  contents: "read"
+
 jobs:
   prepare:
     runs-on: ubuntu-latest
@@ -58,33 +62,33 @@ jobs:
     runs-on: ubuntu-latest
     needs: [ "check" ]
     steps:
-    - uses: actions/checkout@v3
-
-    - name: Install Nix
-      uses: DeterminateSystems/nix-installer-action@main
-    - name: Configure Nix cache
-      uses: DeterminateSystems/magic-nix-cache-action@main
-
-    - name: Setup rust cache
-      uses: actions/cache@v3
-      with:
-        key: photonic-${{ hashFiles('**/Cargo.lock') }}
-        path: |
-          ~/.cargo/bin/
-          ~/.cargo/registry/index/
-          ~/.cargo/registry/cache/
-          ~/.cargo/git/db/
-          target/
-
-    - name: Build
-      run: |
-        nix develop --command \
-            cargo build --all --verbose
-
-    - name: Run tests
-      run: |
-        nix develop --command \
-            cargo test --all --verbose
+      - uses: actions/checkout@v3
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Configure Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@main
+
+      - name: Setup rust cache
+        uses: actions/cache@v3
+        with:
+          key: photonic-${{ hashFiles('**/Cargo.lock') }}
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+
+      - name: Build
+        run: |
+          nix develop --command \
+              cargo build --all --verbose
+
+      - name: Run tests
+        run: |
+          nix develop --command \
+              cargo test --all --verbose
 
   package:
     runs-on: ubuntu-latest
diff --git a/flake.nix b/flake.nix
index df884b8..1aaab03 100644
--- a/flake.nix
+++ b/flake.nix
@@ -6,7 +6,6 @@
 
     crane = {
       url = "github:ipetkov/crane";
-      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     flake-utils.url = "github:numtide/flake-utils";
@@ -15,7 +14,6 @@
       url = "github:oxalica/rust-overlay";
       inputs = {
         nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
       };
     };
 
@@ -49,12 +47,12 @@
           nativeBuildInputs = with pkgs; [
             pkg-config
             protobuf
-            alsa-lib
-            lua5_4
           ];
 
           buildInputs = with pkgs; [
             openssl
+            alsa-lib
+            lua5_4
           ] ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
             pkgs.libiconv
           ];