diff --git a/.github/workflows/notify-front-desk.yml b/.github/workflows/notify-front-desk.yml
index dc0b3ffc..e4188515 100644
--- a/.github/workflows/notify-front-desk.yml
+++ b/.github/workflows/notify-front-desk.yml
@@ -1,4 +1,9 @@
 name: notify-front-desk
+# Per-repo trigger: on issue/PR events, kick the central Front Desk sweep.
+# Grants id-token: write so the OIDC → cf-token-broker mint propagates through
+# the reusable chain (trigger-sync → front-desk-sync) — no secrets (prx-26bq).
+# Without it the sweep fails open; the daily schedule + the brokered
+# front-desk-add (instant per-repo add) remain the backstop.
 on:
   issues:
     types: [opened, closed, reopened, labeled, unlabeled]
@@ -6,5 +11,6 @@ on:
     types: [opened, closed, reopened, labeled, unlabeled]
 jobs:
   sync:
+    permissions:
+      id-token: write # propagate OIDC to front-desk-sync's broker mint
     uses: bounded-systems/gh-project-room/.github/workflows/trigger-sync.yml@main
-    secrets: inherit
diff --git a/nix/oci/nix-builder-box.nix b/nix/oci/nix-builder-box.nix
index 68e27e32..1bb09091 100644
--- a/nix/oci/nix-builder-box.nix
+++ b/nix/oci/nix-builder-box.nix
@@ -41,7 +41,12 @@ let
       cp /run/builder/authorized_keys /root/.ssh/authorized_keys
       chmod 600 /root/.ssh/authorized_keys
     fi
-    printf 'experimental-features = nix-command flakes\ntrusted-users = root\nbuild-users-group =\nsandbox = false\n' > /etc/nix/nix.conf
+    # ssl-cert-file in nix.conf (NOT just env): the remote-build `nix-store
+    # --serve` runs in an ssh session that does NOT inherit the image's
+    # SSL_CERT_FILE, so without this nix can't verify TLS to cache.nixos.org and
+    # falls back to building every dep from source (slow / OOMs). nix.conf is read
+    # regardless of env, fixing substitution for the builder protocol.
+    printf 'experimental-features = nix-command flakes\ntrusted-users = root\nbuild-users-group =\nsandbox = false\nssl-cert-file = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt\n' > /etc/nix/nix.conf
     exec ${pkgs.openssh}/bin/sshd -D -e -f ${sshdConfig}
   '';
 in