diff --git a/.forgejo/workflows/nixos.yaml b/.forgejo/workflows/nixos.yaml
index 4b031f8..40c252e 100644
--- a/.forgejo/workflows/nixos.yaml
+++ b/.forgejo/workflows/nixos.yaml
@@ -1,7 +1,7 @@
 name: nixos
 
-# every push: build the system, so a broken config never reaches main
-# main:       then switch asxpio-services to it
+# every push: evaluate the system, so a broken config never reaches main
+# main:       then build it on asxpio-services and switch to it
 #
 # Secret: SSH_DEPLOY_KEY (user deploy). Service secrets are decrypted on
 # the server by sops-nix, so CI holds none of them.
@@ -29,9 +29,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Build
+      # Job containers are unprivileged, so Nix cannot sandbox builds in
+      # them. Evaluating the system catches config errors; the build
+      # itself happens on the server during the deploy.
+      - name: Evaluate
         working-directory: nixos
-        run: nix build .#nixosConfigurations.asxpio-services.config.system.build.toplevel --no-link --print-out-paths
+        run: nix eval --raw .#nixosConfigurations.asxpio-services.config.system.build.toplevel.drvPath
 
       - name: Set up SSH
         if: github.ref == 'refs/heads/main'
@@ -58,7 +61,7 @@ jobs:
         run: >
           nix shell "$NIXPKGS#nixos-rebuild" "$NIXPKGS#openssh" -c
           nixos-rebuild switch --flake .#asxpio-services
-          --target-host asxpio-services --sudo
+          --target-host asxpio-services --build-host asxpio-services --sudo
 
       - name: Remove credentials
         if: always()
diff --git a/nixos/README.md b/nixos/README.md
index 00b7564..2e4848e 100644
--- a/nixos/README.md
+++ b/nixos/README.md
@@ -20,8 +20,8 @@ Docker-compatible socket, which the CI runner uses to start jobs.
 
 ## Changing something
 
-Edit, push a branch (CI builds the system), merge to `main` (CI
-deploys). By hand, over WireGuard:
+Edit, push a branch (CI evaluates the system), merge to `main` (CI
+builds it on the server and switches to it). By hand, over WireGuard:
 
 ```sh
 nixos-rebuild switch --flake .#asxpio-services --target-host root@10.20.0.20