diff --git a/.github/workflows/flake.yml b/.github/workflows/flake.yml
new file mode 100644
index 0000000000..7a0b364c6c
--- /dev/null
+++ b/.github/workflows/flake.yml
@@ -0,0 +1,37 @@
+---
+name: flake
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref_name }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  # flake.nix derives its toolchain from rust-toolchain.toml, so flake.lock has
+  # to know every nightly that file names. #1201 moved the pin without moving
+  # the lock, and every flake output stopped evaluating. The toolchain-pin
+  # parity guard does not cover this: it compares copies of the pin text, not
+  # the lock's capacity to resolve it.
+  evaluation:
+    name: flake evaluation
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Clone repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31.11.1
+
+      - name: Evaluate development shell and cargo-oxide package
+        run: |
+          nix eval .#devShells.x86_64-linux.default.drvPath
+          nix eval .#packages.x86_64-linux.cargo-oxide.drvPath
diff --git a/Justfile b/Justfile
index 56bf0e17fc..09a06d7a8a 100644
--- a/Justfile
+++ b/Justfile
@@ -131,6 +131,14 @@ check-intrinsics base_ref="HEAD^":
     cargo run -p cuda-intrinsics-gen -- probe --all --skip-terminal
     cargo run -p cuda-intrinsics-gen -- check-abi-history --base-ref {{base_ref}}
 
+# flake.lock has to be able to resolve the pin in rust-toolchain.toml, and
+# nothing else checks that. Kept out of `check` and `check-guards` so those
+# stay runnable without Nix.
+# Evaluate the dev shell and cargo-oxide package against flake.lock (needs Nix)
+check-flake:
+    nix eval .#devShells.x86_64-linux.default.drvPath
+    nix eval .#packages.x86_64-linux.cargo-oxide.drvPath
+
 # Build docs warning-free + run doctests (mirrors the docs CI gate). The `test`
 # recipe uses `--all-targets`, which skips doctests, so this covers them.
 # cuda-bindings is excluded from doctests (its generated C doc comments are not
@@ -221,9 +229,12 @@ check-errors:
 # failed. Keep this list in step when a guard is added to any of the three
 # workflows -- the crate-inventory and toolchain-parity jobs were added to CI
 # without being added here, which is the same drift this recipe exists to
-# prevent. Prerequisites: `cargo-deny` on PATH (`cargo install cargo-deny
-# --locked`) and `python3` (most of the scripts drive it). The scripts are
-# invoked via `bash` as CI does, since not all of them carry an exec bit.
+# prevent. The flake evaluation gate has its own `check-flake` recipe and is
+# deliberately not part of `check-guards`, so contributors without Nix can
+# still run this list. Prerequisites: `cargo-deny` on PATH (`cargo install
+# cargo-deny --locked`) and `python3` (most of the scripts drive it). The
+# scripts are invoked via `bash` as CI does, since not all of them carry an
+# exec bit.
 # Run the status-guard, naming-guard and cargo-deny CI jobs (needs cargo-deny, python3)
 check-guards:
     bash scripts/check-error-example-status.sh
diff --git a/flake.lock b/flake.lock
index 005271198f..c55a6c4d15 100644
--- a/flake.lock
+++ b/flake.lock
@@ -64,11 +64,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778296574,
-        "narHash": "sha256-DVmg1JCjG0VJTa+FF6tH6tkQChaxzK1EzPL98RiRWU0=",
+        "lastModified": 1788077403,
+        "narHash": "sha256-c20YZQKzQ27qC6Wh729fWRTpI7oV4+7Ur4icKssD4Wc=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "1d634a90dffb59ec9ba52652de311b15528c1595",
+        "rev": "89e26eeaafa88a2ede4778734acc794ff0299beb",
         "type": "github"
       },
       "original": {