diff --git a/.forgejo/workflows/cd.yaml b/.forgejo/workflows/cd.yaml
index 8e45cbe0..f2bc9b7e 100644
--- a/.forgejo/workflows/cd.yaml
+++ b/.forgejo/workflows/cd.yaml
@@ -19,8 +19,8 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.CD_SSH_KEY }}" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          eval "$(ssh-agent -s)"
-          ssh-add ~/.ssh/id_ed25519
+          nix-shell --run 'eval "$(ssh-agent -s)"'
+          nix-shell --run 'ssh-add ~/.ssh/id_ed25519'
 
       - name: Deploy
         run: nix-shell --run 'nixops4 apply default'