diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
new file mode 100644
index 0000000..dfd6c22
--- /dev/null
+++ b/.github/actions/setup-nix/action.yml
@@ -0,0 +1,67 @@
+name: setup-nix
+
+inputs:
+  system:
+    type: string
+    required: true
+  sandbox:
+    type: string
+    default: "true"
+
+runs:
+  using: composite
+  steps:
+    - name: reclaim space (linux)
+      if: runner.os == 'Linux'
+      uses: wimpysworld/nothing-but-nix@main
+      with:
+        hatchet-protocol: rampage
+
+    - name: reclaim space (darwin)
+      if: runner.os == 'macOS'
+      shell: bash
+      run: |
+        echo "::group::disk space (before)"
+        sudo df -h
+        echo "::endgroup::"
+
+        echo "::group::disable mds"
+        sudo mdutil -i off -a || echo "mdutil failed"
+        sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.metadata.mds.plist \
+         || echo "launchctl unload failed"
+        echo "::endgroup::"
+
+        echo "Background space expansion started. /nix will grow as space becomes available."
+        sudo rm -rf \
+          /Applications/Xcode_* \
+          /Library/Developer/CoreSimulator \
+          /Library/Frameworks \
+          /Users/runner/.dotnet \
+          /Users/runner/.rustup \
+          /Users/runner/Library/Android \
+          /Users/runner/Library/Caches \
+          /Users/runner/Library/Developer/CoreSimulator \
+          /Users/runner/hostedtoolcache &
+
+    - name: install nix
+      uses: cachix/install-nix-action@v31
+      with:
+        # Putting build-dir in /nix is a workaround for https://github.com/wimpysworld/nothing-but-nix/issues/18
+        extra_nix_config: |
+          build-dir = /nix/build
+          sandbox = ${{ inputs.sandbox }}
+          system = ${{ inputs.system }}
+
+    - name: create build-dir
+      shell: bash
+      run: sudo mkdir -p /nix/build
+
+    - name: post setup-nix
+      if: runner.os == 'macOS'
+      uses: srz-zumix/post-run-action@v2
+      with:
+        shell: bash -e {0}
+        post-run: |
+          echo "::group::disk space (after)"
+          sudo df -h
+          echo "::endgroup::"
\ No newline at end of file
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 471c361..3d7fa42 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,23 +4,57 @@ on:
   push:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   build:
-    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        system:
+          - x86_64-linux
+          - aarch64-linux
+          - x86_64-darwin
+    runs-on: ${{ matrix.system == 'x86_64-linux' && 'ubuntu-24.04'
+      || matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm'
+      || matrix.system == 'x86_64-darwin' && 'macos-latest' }}
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v2
 
-      - name: Install nix
-        uses: cachix/install-nix-action@v16
+      - name: setup nix
+        uses: ./.github/actions/setup-nix
+        with:
+          system: ${{ matrix.system }}
+          
+      - name: Login to tailscale
+        uses: tailscale/github-action@v3.2.3
+        with:
+          oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
+          oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
+          hostname: ${{ matrix.system == 'x86_64-linux' && 'github-actions-x86-64-linux'
+            || matrix.system == 'aarch64-linux' && 'github-actions-aarch64-linux'
+            || matrix.system == 'x86_64-darwin' && 'github-actions-x86-64-darwin' }}
+          tags: tag:ci
 
+      - name: Check if Attic endpoint is reachable
+        id: check_attic
+        run: |
+          if curl --connect-timeout 5 --silent --head http://wallfacer.curl-boga.ts.net:7080 | grep "200 OK"; then
+            echo "reachable=true" >> $GITHUB_OUTPUT
+          else
+            echo "reachable=false" >> $GITHUB_OUTPUT
+          fi
 
-      # TODO: add a binary cache
-      # - uses: cachix/cachix-action@v10
-      #   with:
-      #     name: YOURCACHE
-      #     authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-
+      - name: Setup Attic cache
+        if: steps.check_attic.outputs.reachable == 'true'
+        uses: ryanccn/attic-action@v0.3.1
+        with:
+          endpoint: http://wallfacer.curl-boga.ts.net:7080
+          cache: main
+          token: ${{ secrets.ATTIC_TOKEN }}
 
       - name: Check the flake
         run: nix flake check --accept-flake-config
diff --git a/config/plugins/avante.nix b/config/plugins/avante.nix
index 50f5647..dbe9ec7 100644
--- a/config/plugins/avante.nix
+++ b/config/plugins/avante.nix
@@ -5,14 +5,14 @@
       # provider = "ollama";
       # provider = "claude";
       providers = {
-      #   claude = {
-      #     endpoint = "https://api.anthropic.com";
-      #     extra_request_body = {
-      #       max_tokens = 4096;
-      #       temperature = 0;
-      #     };
-      #     model = "claude-3-5-sonnet-20240620";
-      #   };
+        #   claude = {
+        #     endpoint = "https://api.anthropic.com";
+        #     extra_request_body = {
+        #       max_tokens = 4096;
+        #       temperature = 0;
+        #     };
+        #     model = "claude-3-5-sonnet-20240620";
+        #   };
         ollama = {
           endpoint = "http://localhost:11434";
           model = "qwen2.5-coder:32b";