diff --git a/.github/actions/stack-test/action.yml b/.github/actions/stack-test/action.yml
new file mode 100644
index 0000000..bc6e650
--- /dev/null
+++ b/.github/actions/stack-test/action.yml
@@ -0,0 +1,22 @@
+name: stack test
+description: Build and test with stack
+runs:
+  using: composite
+  steps:
+    - uses: haskell/ghcup-setup@v1
+      id: ghcup
+      with:
+        stack-hook: true
+    - uses: actions/cache@v4
+      with:
+        path: |
+          ${{ steps.ghcup.outputs.basedir }}
+          ~/.stack
+        key: stack-${{ runner.os }}-${{ hashFiles('stack.yaml') }}
+        restore-keys: |
+          stack-${{ runner.os }}-
+          ${{ runner.os }}-
+    - run: ghcup install stack
+      shell: bash
+    - run: stack test
+      shell: bash
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ca79ca5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dd14fd6..11d6768 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,4 +1,5 @@
-name: check and push
+# CI that runs on pull requests and pushes to master.
+name: CI
 on:
   push:
     branches:
@@ -12,46 +13,17 @@ jobs:
     name: stack test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: haskell/ghcup-setup@v1
-        id: ghcup
-        with:
-          stack-hook: true
-      - uses: actions/cache@v4
-        with:
-          path: |
-            ${{ steps.ghcup.outputs.basedir }}
-            ~/.stack
-          key: stack-${{ runner.os }}-${{ hashFiles('stack.yaml') }}
-          restore-keys: |
-            stack-${{ runner.os }}-
-            ${{ runner.os }}-
-      - run: ghcup install stack
-      - run: stack test
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/stack-test
 
-  flake-no-push:
-    name: flake check (no push)
-    if: github.event_name != 'push'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v31
-      - uses: cachix/cachix-action@v15
-        with:
-          name: stackage-infrastructure
-      - run: nix build
-      - run: nix flake check
-
-  flake-push:
+  flake-check:
     name: flake check and push
     if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: cachix/install-nix-action@v31
-      - uses: cachix/cachix-action@v15
-        with:
-          name: stackage-infrastructure
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
+      - uses: cachix/cachix-action@v17
       - run: nix build
       - run: nix flake check
diff --git a/.github/workflows/cache-warmup.yaml b/.github/workflows/cache-warmup.yaml
new file mode 100644
index 0000000..88b7607
--- /dev/null
+++ b/.github/workflows/cache-warmup.yaml
@@ -0,0 +1,13 @@
+name: biweekly cache warmup
+on:
+  schedule:
+    # Every Monday and Thursday at 11:23 UTC
+    - cron: '23 11 * * mon,thu'
+  workflow_dispatch:
+jobs:
+  stack-test:
+    name: stack test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: ./.github/actions/stack-test