diff --git a/machines/core/nix.nix b/machines/core/nix.nix
index 6a23115..022c67e 100644
--- a/machines/core/nix.nix
+++ b/machines/core/nix.nix
@@ -12,6 +12,13 @@
 
     settings = {
       auto-optimise-store = true;
+      # Without these, gc sweeps away eval-time-only sources (flake inputs,
+      # their build deps) since they're not part of the runtime closure.
+      # The next evaluation then cold-refetches everything from GitHub,
+      # which is enough on its own to trip GitHub's unauthenticated rate
+      # limit for large dependency trees (e.g. hermes-agent's).
+      keep-outputs = true;
+      keep-derivations = true;
     };
 
     gc = {
diff --git a/machines/jupiter/configuration.nix b/machines/jupiter/configuration.nix
index 9a54eaa..231461f 100644
--- a/machines/jupiter/configuration.nix
+++ b/machines/jupiter/configuration.nix
@@ -72,6 +72,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }
diff --git a/machines/mibook/configuration.nix b/machines/mibook/configuration.nix
index 80d4d66..30c4a05 100644
--- a/machines/mibook/configuration.nix
+++ b/machines/mibook/configuration.nix
@@ -61,6 +61,9 @@
 
   system = {
     stateVersion = "23.05";
-    autoUpgrade.enable = true;
+    # Was silently failing daily (legacy channel path, no --flake set) without
+    # ever reaching the network. Disabled rather than fixed: rebuilds should
+    # only happen when triggered manually.
+    autoUpgrade.enable = false;
   };
 }