diff --git a/README.md b/README.md
index eb65c1c..1fded49 100644
--- a/README.md
+++ b/README.md
@@ -43,8 +43,12 @@ devenv allow
 ```
 
 ### Devenv maintainer
+
+Push the current devenv closure to the RSSBase Cachix cache when Nix/devenv inputs change.
+Do not keep `cachix.push` enabled in `devenv.local.nix`: it slows normal shell entry.
+
 ```bash
-CACHIX_AUTH_TOKEN=... devenv shell true
+CACHIX_AUTH_TOKEN=... devenv shell cachix-push
 ```
 <details>
 
diff --git a/devenv.cachix.nix b/devenv.cachix.nix
new file mode 100644
index 0000000..6eb6585
--- /dev/null
+++ b/devenv.cachix.nix
@@ -0,0 +1,32 @@
+{ pkgs, ... }:
+
+{
+  scripts.cachix-push.exec = ''
+    set -eu
+
+    if [ -z "''${CACHIX_AUTH_TOKEN:-}" ] && [ -z "''${CACHIX_SIGNING_KEY:-}" ]; then
+      echo "error: set CACHIX_AUTH_TOKEN=... or CACHIX_SIGNING_KEY before running devenv-cachix-push" >&2
+      exit 1
+    fi
+
+    set --
+    for path in \
+      .devenv/gc/shell \
+      .devenv/profile \
+      .devenv/gc/task-config-devenv-config-task-config \
+      .devenv/gc/test-devenv-config-test \
+      .devenv/gc/changelog-json-devenv-config-changelog-json
+    do
+      if [ -e "$path" ]; then
+        set -- "$@" "$(readlink -f "$path")"
+      fi
+    done
+
+    if [ "$#" -eq 0 ]; then
+      echo "error: no devenv store paths found; run this through 'devenv shell devenv-cachix-push'" >&2
+      exit 1
+    fi
+
+    ${pkgs.cachix}/bin/cachix push rssbase "$@"
+  '';
+}
diff --git a/devenv.nix b/devenv.nix
index 7297405..fab5f58 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -9,6 +9,8 @@ let
   devenvSummary = pkgs.callPackage ./devenv.custom-code.nix { };
 in
 {
+  imports = [ ./devenv.cachix.nix ];
+
   # https://devenv.sh/packages/
   packages = [
     pkgs.docker-buildx  # BuildKit builder for CI image builds