diff --git a/deploy/push-cache.sh b/deploy/push-cache.sh
index 6eb1832..0604204 100755
--- a/deploy/push-cache.sh
+++ b/deploy/push-cache.sh
@@ -29,8 +29,22 @@ build_and_push() {
   local attr="$2"
 
   echo "==> Building $name ($attr)..."
-  nix build ".#$attr" --no-link --print-out-paths | cachix push "$CACHE"
-  echo "==> Pushed $name to $CACHE.cachix.org"
+  local out_paths
+  out_paths=$(nix build ".#$attr" --no-link --print-out-paths)
+
+  # Walk the BUILD-TIME closure (not just runtime) so derivations like
+  # `bitspire-atm-app-pnpm-deps` (fetchPnpmDeps tarball, consumed only
+  # during the app's build and discarded) land in the cache. Without
+  # this, ATMs that need to rebuild the app from source — i.e. any time
+  # `cachix push` already-cached the runtime output but a downstream
+  # eval needs a new toplevel that re-derives the app — would OOM-kill
+  # themselves trying to run `pnpm install` locally on 1 GB of RAM.
+  # OOM caught on Sintra 2026-05-25 with the 1.4 GB pnpm-deps build.
+  local drvs
+  drvs=$(echo "$out_paths" | xargs -r -n1 nix-store -q --deriver)
+  echo "$drvs" | xargs -r nix-store -qR --include-outputs | cachix push "$CACHE"
+
+  echo "==> Pushed $name (runtime + build-time closure) to $CACHE.cachix.org"
 }
 
 case "$target" in