diff --git a/flake.nix b/flake.nix
index 39f925a..3a07c1e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -108,7 +108,10 @@
               security.sudo.wheelNeedsPassword = false;
 
               # Allow lamassu user to use nix commands + pull from aiolabs binary cache
+              # max-jobs = 0: never build locally — only download from substituters.
+              # If a derivation isn't cached, the build fails instead of compiling on the ATM.
               nix.settings = {
+                max-jobs = 0;
                 trusted-users = [ "root" "lamassu" ];
                 substituters = [ "https://cache.nixos.org" "https://aiolabs.cachix.org" ];
                 trusted-public-keys = [