diff --git a/.github/actions/init/action.yaml b/.github/actions/init/action.yaml
index 44078ef..01cb430 100644
--- a/.github/actions/init/action.yaml
+++ b/.github/actions/init/action.yaml
@@ -1,4 +1,11 @@
 name: "initialize"
+description: "install nix & use cachix"
+
+inputs:
+  token:
+    description: "cachix auth token"
+    required: true
+
 runs:
   using: "composite"
   steps:
@@ -11,4 +18,4 @@ runs:
       uses: cachix/cachix-action@v16
       with:
         name: trevstack
-        authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+        authToken: "${{ inputs.token }}"
diff --git a/.github/workflows/check.yaml b/.github/workflows/check.yaml
index 645ffb0..5e66fe9 100644
--- a/.github/workflows/check.yaml
+++ b/.github/workflows/check.yaml
@@ -17,6 +17,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/init
+        with:
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: Check
         run: nix flake check
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index b090371..0c1704b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,6 +15,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/init
+        with:
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: check
         run: nix flake check
@@ -25,6 +27,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/init
+        with:
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: build
         run: >
@@ -49,6 +53,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/init
+        with:
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       - name: set env
         run: |
diff --git a/.github/workflows/update.yaml b/.github/workflows/update.yaml
index d64c579..74cb29d 100644
--- a/.github/workflows/update.yaml
+++ b/.github/workflows/update.yaml
@@ -15,6 +15,8 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/init
+        with:
+          token: "${{ secrets.CACHIX_AUTH_TOKEN }}"
 
       # https://github.com/actions/checkout/issues/13
       - name: set git config