diff --git a/.circleci/config.yml b/.circleci/config.yml
index dc041b7bfd568d2d91a2a5f7b484061c7029842a..30b07431709556900d6b0b3d27d11533dc9367f9 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -169,8 +169,9 @@ jobs:
     steps:
       - run:
           name: "Set up Cachix"
+          shell: "nix-shell -p cachix bash"
           command: |
-            nix-env -iA nixpkgs.cachix nixpkgs.bash
+            set -eo pipefail
             cachix use "${CACHIX_NAME}"
             nix path-info --all > /tmp/store-path-pre-build
 
@@ -196,8 +197,11 @@ jobs:
 
       - run:
           name: "Push to Cachix"
+          shell: "nix-shell -p cachix bash"
           when: "always"
           command: |
+            set -eo pipefail
+
             # Cribbed from
             # https://circleci.com/blog/managing-secrets-when-you-have-pull-requests-from-outside-contributors/
             if [ -n "$CIRCLE_PR_NUMBER" ]; then