We do need better CI, since right now the GitHub Actions build is almost completely broken. I think the builders are running out of memory. I can try further reducing the number of jobs, but then I think it will still run into the maximum build time limit.

I do build this overlay on my private Hydra instance, but I'd like to keep it private since it builds a lot of other stuff as well.

Adding remote builders to the GitHub Actions CI is a possibility, but it would put you and anyone else with admin access to the build servers in a position of trust, and even if this is clearly documented, that doesn't mean that existing users would necessarily be comfortable with it.

In fact, I should probably make it more clear in the documentation that by using the binary cache, you are effectively giving me code execution on your machine (even root privileges in some cases). There may be a false sense of security because the packages are built on GitHub Actions, but this is moot because I control the Cachix private key.