diff --git a/flake.nix b/flake.nix
index 37e22e2..ceb7be9 100644
--- a/flake.nix
+++ b/flake.nix
@@ -139,11 +139,19 @@
               # Passwordless sudo for remote nixos-rebuild switch
               security.sudo.wheelNeedsPassword = false;
 
-              # Allow lamassu user to use nix commands + pull from aiolabs binary cache
-              # max-jobs = 0: never build locally — only download from substituters.
-              # If a derivation isn't cached, the build fails instead of compiling on the ATM.
+              # Allow lamassu user to use nix commands + pull from aiolabs binary cache.
+              # max-jobs = 1: prefer substitution from the cache, but allow ONE
+              # local build slot for tiny activation-time stitch derivations
+              # (boot.json, system-units, X-Restart-Triggers, etc.) that are
+              # inherently per-machine and can never be pre-cached. Heavy
+              # nixpkgs compiles (rustc, kernel, electron) are still
+              # effectively cache-only — they're upstream-cached, so a cache
+              # miss on them stays vanishingly rare in practice.
+              # max-jobs = 0 was tried first and silently bricked nightly
+              # auto-upgrades for 6+ days on an uncacheable trivial derivation
+              # (systemd-boot's boot.json).
               nix.settings = {
-                max-jobs = 0;
+                max-jobs = 1;
                 trusted-users = [ "root" "lamassu" ];
                 substituters = [ "https://cache.nixos.org" "https://aiolabs.cachix.org" ];
                 trusted-public-keys = [