diff --git a/.github/actions/arc_env/action.yml b/.github/actions/arc_env/action.yml
new file mode 100644
index 0000000..5114f92
--- /dev/null
+++ b/.github/actions/arc_env/action.yml
@@ -0,0 +1,20 @@
+name: "ARC environment"
+runs:
+  using: "composite"
+  steps:
+    - name: Authenticate nix's github fetches
+      shell: bash
+      run: |
+        # Writing to GITHUB_ENV replaces, so preserve any existing NIX_CONFIG.
+        {
+          echo "NIX_CONFIG<<NIX_CONFIG_EOF"
+          if [[ -n "${NIX_CONFIG:-}" ]]; then echo "$NIX_CONFIG"; fi
+          echo "access-tokens = github.com=${{ github.token }}"
+          echo "NIX_CONFIG_EOF"
+        } >> "$GITHUB_ENV"
+
+    # Separate step: GITHUB_ENV only lands in the next one, and this eval needs the token.
+    - name: Set NIX_PATH from the flake's own nixpkgs
+      shell: bash
+      run: |
+        echo "NIX_PATH=nixpkgs=$(nix run .#nixpkgsPath)" >> "$GITHUB_ENV"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 00b95ec..9928ffe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,13 +7,15 @@ on:
 jobs:
   tests:
     name: tests
-    runs-on: [self-hosted, Linux, desktop]
+    runs-on: arc-public-large
     strategy:
       fail-fast: false
 
     steps:
     - uses: actions/checkout@v6
 
+    - uses: ./.github/actions/arc_env
+
     - name: Run tests
       run: |
         TESTS=$(nix build --no-link --print-out-paths .#tests)/bin/java-notebook-language-server-test
@@ -27,19 +29,13 @@ jobs:
         path: test_runs/
 
   no-gmp:
-    runs-on: [self-hosted, Linux, desktop]
+    runs-on: arc-public-small
     strategy:
       fail-fast: false
     steps:
     - uses: actions/checkout@v6
 
-    - uses: cachix/install-nix-action@v31
-      with:
-        nix_path: nixpkgs=channel:release-25.11
-        # extra_nix_config: |
-        #   trusted-public-keys = iohk.cachix.org-1:DpRUyj7h7V830dp/i6Nti+NEO2/nhblbov/8MW7Rqoo= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-        #   substituters = https://iohk.cachix.org https://cache.nixos.org/
-    # - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: ./.github/actions/arc_env
 
     - name: No GMP
       run: |
@@ -47,20 +43,14 @@ jobs:
 
   nix:
     name: Nix
-    runs-on: [self-hosted, Linux, desktop]
+    runs-on: arc-public-small
     strategy:
       fail-fast: false
 
     steps:
     - uses: actions/checkout@v6
 
-    - uses: cachix/install-nix-action@v31
-      with:
-        nix_path: nixpkgs=channel:release-25.11
-        # extra_nix_config: |
-        #   trusted-public-keys = iohk.cachix.org-1:DpRUyj7h7V830dp/i6Nti+NEO2/nhblbov/8MW7Rqoo= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
-        #   substituters = https://iohk.cachix.org https://cache.nixos.org/
-    # - uses: DeterminateSystems/magic-nix-cache-action@main
+    - uses: ./.github/actions/arc_env
 
     - name: Build
       run: |