diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 9c96068f..6d93b010 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,10 +42,17 @@ jobs:
         run: |
           cachix watch-exec holochain-open-dev -- nix build --no-update-lock-file --accept-flake-config -L .#file_storage_integrity
           cachix push holochain-open-dev $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage_integrity | jq -r 'keys[0]')
-          cachix pin holochain-open-dev file_storage_integrity_debug $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage_integrity | jq -r 'keys[0]')
 
           cachix watch-exec holochain-open-dev -- nix build --no-update-lock-file --accept-flake-config -L .#file_storage
           cachix push holochain-open-dev $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage | jq -r 'keys[0]')
+    
+      - name: Pin debug zomes
+        if: github.event_name != 'pull_request'
+        env:
+          CACHIX_AUTH_TOKEN: "${{ secrets.CACHIX_TOKEN_HOLOCHAIN_OPEN_DEV }}"
+        run: |
+          cachix pin holochain-open-dev file_storage_integrity_debug $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage_integrity | jq -r 'keys[0]')
+
           cachix pin holochain-open-dev file_storage_debug $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage | jq -r 'keys[0]')
 
       - name: Build release zomes
@@ -55,8 +62,15 @@ jobs:
         run: |
           cachix watch-exec holochain-open-dev -- nix build --no-update-lock-file --accept-flake-config -L .#file_storage_integrity.meta.release
           cachix push holochain-open-dev $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage_integrity.meta.release | jq -r 'keys[0]')
-          cachix pin holochain-open-dev file_storage_integrity $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage_integrity.meta.release | jq -r 'keys[0]')
 
           cachix watch-exec holochain-open-dev -- nix build --no-update-lock-file --accept-flake-config -L .#file_storage.meta.release
           cachix push holochain-open-dev $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage.meta.release | jq -r 'keys[0]')
+
+      - name: Pin release zomes
+        if: matrix.os == 'ubuntu-latest' && github.event_name != 'pull_request'
+        env:
+          CACHIX_AUTH_TOKEN: "${{ secrets.CACHIX_TOKEN_HOLOCHAIN_OPEN_DEV }}"
+        run: |
+          cachix pin holochain-open-dev file_storage_integrity $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage_integrity.meta.release | jq -r 'keys[0]')
+
           cachix pin holochain-open-dev file_storage $(nix path-info --json --accept-flake-config --no-warn-dirty .#file_storage.meta.release | jq -r 'keys[0]')