diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffed4ce90..0d2e7e52b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,41 +23,32 @@ jobs:
 
   rust:
     runs-on: ubuntu-22.04
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
       - name: Check formatting
-        run: cargo fmt --all --check
+        run: nix develop --command cargo fmt --all --check
       - name: Run clippy
-        run: cargo clippy --locked --workspace --all-targets -- -D warnings
+        run: nix develop --command cargo clippy --locked --workspace --all-targets -- -D warnings
       - name: Run library tests
-        run: cargo test --locked --workspace --lib
+        run: nix develop --command cargo test --locked --workspace --lib
 
   web:
     runs-on: ubuntu-22.04
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
       - name: Build web bundle
-        run: trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+        run: nix develop --command trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
       - name: Validate website assembly
-        run: python3 scripts/test_site.py
+        run: nix develop --command python3 scripts/test_site.py
       - name: Validate locale lookups
-        run: python3 scripts/test_locales.py
+        run: nix develop --command python3 scripts/test_locales.py
 
   release-automation:
     runs-on: ubuntu-22.04
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-nix
       - name: Test release automation
-        run: python3 scripts/test_release.py
+        run: nix develop --command python3 scripts/test_release.py
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 904c81bc8..b4c4ad4d2 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -33,9 +33,6 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-22.04
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     outputs:
       tag: ${{ steps.source.outputs.tag }}
       commit: ${{ steps.source.outputs.commit }}
@@ -80,6 +77,7 @@ jobs:
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           git merge-base --is-ancestor "$RELEASE_TAG" HEAD
           if [ -f scripts/release.py ]; then
             python3 scripts/release.py versions --tag "$RELEASE_TAG"
@@ -87,9 +85,10 @@ jobs:
             VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)
             test "v$VERSION" = "$RELEASE_TAG"
           fi
+          EOF
 
       - name: Build web bundle
-        run: trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+        run: nix develop --command trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
 
       - name: Check out current website
         uses: actions/checkout@v4
@@ -99,27 +98,29 @@ jobs:
 
       - name: Validate website
         working-directory: website
-        run: python3 scripts/test_site.py
+        run: nix develop --command python3 scripts/test_site.py
 
       - name: Assemble landing page
         working-directory: website
-        run: sh scripts/assemble-site.sh "$GITHUB_WORKSPACE/dist"
+        run: nix develop --command sh scripts/assemble-site.sh "$GITHUB_WORKSPACE/dist"
 
       - name: Record website source
         working-directory: website
-        run: git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"
+        run: nix develop --command bash --noprofile --norc -euo pipefail -c 'git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"'
 
       - name: Record release version and source
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
           RELEASE_COMMIT: ${{ steps.source.outputs.commit }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           jq -n --arg version "${RELEASE_TAG#v}" --arg commit "$RELEASE_COMMIT" \
             '{version: $version, commit: $commit}' > dist/app/release.json
+          EOF
 
       # GitHub Pages runs Jekyll, which ignores files; opt out so the
       # wasm-bindgen output is served verbatim.
-      - run: touch dist/.nojekyll
+      - run: nix develop --command touch dist/.nojekyll
 
       # The web app can't call the Patreon API directly (CORS + the token would
       # be exposed in the bundle), so generate the supporters list server-side
@@ -129,7 +130,7 @@ jobs:
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
         run: |
-          python3 - <<'PY'
+          nix develop --command python3 - <<'PY'
           import json
           import os
           import urllib.parse
@@ -243,7 +244,7 @@ jobs:
       - name: Generate project growth charts
         env:
           GITHUB_TOKEN: ${{ secrets.OCS_GITHUB_TOKEN }}
-        run: python3 website/scripts/generate-star-history.py --output-dir dist
+        run: nix develop --command python3 website/scripts/generate-star-history.py --output-dir dist
 
       # Browsers cannot reliably fetch YouTube playlist/oEmbed responses because
       # of CORS. Build a same-origin listing and thumbnail directory for the
@@ -251,7 +252,7 @@ jobs:
       # unavailable during deployment.
       - name: Generate videos.json
         run: |
-          python3 - <<'PY'
+          nix develop --command python3 - <<'PY'
           import json
           import re
           import shutil
@@ -314,6 +315,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           QUERY='
             query($owner: String!, $name: String!) {
               repository(owner: $owner, name: $name) {
@@ -358,6 +360,7 @@ jobs:
                   })' \
             > dist/app/discussions.json
           echo "discussions: $(jq 'length' dist/app/discussions.json)"
+          EOF
 
       - uses: actions/upload-pages-artifact@v3
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6cd532d17..4dbb04c61 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,9 +33,6 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: write
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
 
     steps:
       - name: Checkout
@@ -50,15 +47,16 @@ jobs:
 
       - name: Validate package versions
         id: version
-        run: python3 scripts/release.py versions --tag "$RELEASE_TAG"
+        run: nix develop --command python3 scripts/release.py versions --tag "$RELEASE_TAG"
 
       - name: Build
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
-        run: cargo build --locked --release
+        run: nix develop --command cargo build --locked --release
 
       - name: Prepare AppDir
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           mkdir -p AppDir/usr/bin
           mkdir -p AppDir/usr/share/applications
           mkdir -p AppDir/usr/share/icons/hicolor/256x256/apps
@@ -68,9 +66,10 @@ jobs:
           cp packaging/io.github.HakanSeven12.OpenCadStudio.metainfo.xml AppDir/usr/share/metainfo/
           rsvg-convert -w 256 -h 256 assets/logo.svg \
             -o AppDir/usr/share/icons/hicolor/256x256/apps/io.github.HakanSeven12.OpenCadStudio.png
+          EOF
 
       - name: Pack shared Linux payload
-        run: tar -C AppDir -czf linux-payload.tar.gz usr
+        run: nix develop --command tar -C AppDir -czf linux-payload.tar.gz usr
 
       - name: Upload shared Linux payload
         uses: actions/upload-artifact@v4
@@ -82,28 +81,34 @@ jobs:
 
       - name: Download linuxdeploy
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           wget -q https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
           chmod +x linuxdeploy-x86_64.AppImage
+          EOF
 
       - name: Build AppImage
         env:
           APPIMAGE_EXTRACT_AND_RUN: 1
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           ./linuxdeploy-x86_64.AppImage \
             --appdir AppDir \
             --desktop-file AppDir/usr/share/applications/io.github.HakanSeven12.OpenCadStudio.desktop \
             --icon-file AppDir/usr/share/icons/hicolor/256x256/apps/io.github.HakanSeven12.OpenCadStudio.png \
             --output appimage
           mv Open*CAD*Studio*.AppImage OpenCADStudio.AppImage
+          EOF
 
       - name: Upload AppImage to release
         if: env.RELEASE_TAG != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           ASSET=OpenCADStudio-${{ env.RELEASE_TAG }}-linux-x86_64.AppImage
           mv OpenCADStudio.AppImage "$ASSET"
           gh release upload ${{ env.RELEASE_TAG }} "$ASSET" --clobber --repo ${{ github.repository }}
+          EOF
 
   build-snap:
     needs: build-appimage
@@ -115,9 +120,6 @@ jobs:
     permissions:
       actions: read
       contents: write
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     env:
       SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
 
@@ -134,7 +136,7 @@ jobs:
 
       - name: Validate package versions
         id: version
-        run: python3 scripts/release.py versions --tag "$RELEASE_TAG"
+        run: nix develop --command python3 scripts/release.py versions --tag "$RELEASE_TAG"
 
       - name: Download shared Linux payload
         uses: actions/download-artifact@v4
@@ -147,8 +149,10 @@ jobs:
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           sed -i "s/^version: .*/version: '$VERSION'/" snap/snapcraft.yaml
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          EOF
 
       - name: Build snap
         id: snapcraft
@@ -160,16 +164,18 @@ jobs:
           SNAP: ${{ steps.snapcraft.outputs.snap }}
           VERSION: ${{ steps.package.outputs.version }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           PACKAGE="OpenCADStudio-v${VERSION}-linux-x86_64.snap"
           mv "$SNAP" "$PACKAGE"
           echo "snap=$PACKAGE" >> "$GITHUB_OUTPUT"
+          EOF
 
       - name: Upload snap to release
         if: env.RELEASE_TAG != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SNAP: ${{ steps.snap_package.outputs.snap }}
-        run: gh release upload "${{ env.RELEASE_TAG }}" "$SNAP" --clobber
+        run: nix develop --command gh release upload "${{ env.RELEASE_TAG }}" "$SNAP" --clobber
 
       - name: Upload snap as workflow artifact
         if: env.RELEASE_TAG == ''
@@ -539,9 +545,6 @@ jobs:
     runs-on: ubuntu-22.04
     permissions:
       contents: read
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -550,4 +553,4 @@ jobs:
       - name: Verify native release assets and notes
         env:
           GH_TOKEN: ${{ github.token }}
-        run: python3 scripts/release.py verify-native --tag "$RELEASE_TAG"
+        run: nix develop --command python3 scripts/release.py verify-native --tag "$RELEASE_TAG"
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index 7002d8630..a502005ba 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -25,9 +25,6 @@ jobs:
   prepare:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-22.04
-    defaults:
-      run:
-        shell: 'nix develop --command bash --noprofile --norc -euo pipefail {0}'
     outputs:
       ready: ${{ steps.release.outputs.ready }}
       tag: ${{ steps.release.outputs.tag }}
@@ -39,18 +36,20 @@ jobs:
           fetch-depth: 0
       - uses: ./.github/actions/setup-nix
       - name: Validate release automation
-        run: python3 scripts/test_release.py
+        run: nix develop --command python3 scripts/test_release.py
       - name: Prepare release and verify published notes
         id: release
         env:
           GH_TOKEN: ${{ github.token }}
           PUBLISH: ${{ github.event_name == 'schedule' || inputs.publish }}
         run: |
+          nix develop --command bash --noprofile --norc -euo pipefail <<'EOF'
           if [ "$PUBLISH" = true ]; then
             python3 scripts/release.py prepare --publish
           else
             python3 scripts/release.py prepare
           fi
+          EOF
 
   # GITHUB_TOKEN releases do not trigger release events, so call both builds.
   web: