diff --git a/.forgejo/workflows/test.yaml b/.forgejo/workflows/test.yaml
index 32b288b..544bd73 100644
--- a/.forgejo/workflows/test.yaml
+++ b/.forgejo/workflows/test.yaml
@@ -10,6 +10,7 @@ on:
 jobs:
   test:
     runs-on: nixos-do-s
+    enable-openid-connect: true
     steps:
       - name: Check out
         uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -26,10 +27,17 @@ jobs:
       - name: Build
         run: nix develop -c zig build
 
+      - name: Push to the cache
+        if: ${{ !cancelled() && forge.ref == 'refs/heads/main' }}
+        uses: https://git.jcollie.dev/jeff/niks3-push@3f85f501658e379783381291241c6f8315a92716
+        with:
+          server-url: https://niks3.jcollie.dev
+
   docs:
     needs: test
     if: ${{ forge.ref == 'refs/heads/main' }}
     runs-on: nixos-do-s
+    enable-openid-connect: true
     steps:
       - name: Check out
         uses: https://code.forgejo.org/actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -43,3 +51,9 @@ jobs:
           --server jcollie.page
           --token ${{ forge.token }}
           --upload-dir zig-out/docs
+
+      - name: Push to the cache
+        if: ${{ !cancelled() && forge.ref == 'refs/heads/main' }}
+        uses: https://git.jcollie.dev/jeff/niks3-push@3f85f501658e379783381291241c6f8315a92716
+        with:
+          server-url: https://niks3.jcollie.dev
diff --git a/README.md b/README.md
index f41eaf6..baff3a3 100644
--- a/README.md
+++ b/README.md
@@ -265,7 +265,9 @@ Every push runs three checks on a Forgejo runner: REUSE compliance,
 `zig fmt --check .`, and the test suite. `.forgejo/workflows/test.yaml` drives
 them all through `nix develop`, so the runner needs nothing but Nix and gets
 exactly the toolchain `flake.nix` pins. When those pass on `main`, a second job builds the API documentation and publishes
-it to <https://jeff.jcollie.page/zig-mp3/>.
+it to <https://jeff.jcollie.page/zig-mp3/>. Both jobs finish on `main` by
+pushing what Nix built to the project's Nix cache, so that the next run
+substitutes it rather than building it again.
 
 For a much wider sweep, `tools/check-against-ffmpeg.py` generates a synthetic
 source, encodes it at forty-one combinations of layer, version, sampling frequency,