diff --git a/.github/workflows/cachix-latest-tag.yml b/.github/workflows/cachix-latest-tag.yml
new file mode 100644
index 0000000..ae3a3a7
--- /dev/null
+++ b/.github/workflows/cachix-latest-tag.yml
@@ -0,0 +1,80 @@
+name: Cachix (latest tag)
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *"
+  push:
+    tags: [ "*" ]
+
+permissions: {}
+
+jobs:
+  build_nixpkgs_stable:
+    name: Build and push to Cachix (nixpkgs 25.11)
+    runs-on: ubuntu-latest
+    environment: cachix
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          submodules: 'recursive'
+
+      - name: Check out latest tag
+        run: git checkout "$(git describe --tags "$(git rev-list --tags --max-count=1)")"
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0
+        with:
+          nix_path: nixpkgs=channel:nixos-25.11
+
+      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+        with:
+          name: inputactions
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Patch flake.nix
+        run: sed -i -e 's/nixos-unstable/nixos-25.11/g' flake.nix
+
+      - name: Update flake.lock
+        run: nix flake update
+
+      - name: Build
+        run: nix build -L .?submodules=1#inputactions-kwin
+
+  build_nixpkgs_unstable:
+    name: Build and push to Cachix (nixpkgs unstable)
+    runs-on: ubuntu-latest
+    environment: cachix
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          submodules: 'recursive'
+
+      - name: Check out latest tag
+        run: git checkout "$(git describe --tags "$(git rev-list --tags --max-count=1)")"
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@19effe9fe722874e6d46dd7182e4b8b7a43c4a99 # v31.10.0
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+        with:
+          name: inputactions
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Update flake.lock
+        run: nix flake update
+
+      - name: Build
+        run: nix build -L .?submodules=1#inputactions-kwin
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
diff --git a/.github/workflows/cachix.yml b/.github/workflows/cachix.yml
index bdc44e4..e7c0e37 100644
--- a/.github/workflows/cachix.yml
+++ b/.github/workflows/cachix.yml
@@ -9,9 +9,10 @@ on:
 permissions: {}
 
 jobs:
-  build_stable:
+  build_nixpkgs_stable:
     name: Build and push to Cachix (nixpkgs 25.11)
     runs-on: ubuntu-latest
+    environment: cachix
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -38,9 +39,10 @@ jobs:
       - name: Build
         run: nix build -L .?submodules=1#inputactions-kwin
 
-  build_unstable:
+  build_nixpkgs_unstable:
     name: Build and push to Cachix (nixpkgs unstable)
     runs-on: ubuntu-latest
+    environment: cachix
     steps:
       - name: Check out repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2