diff --git a/.github/workflows/workflow.yaml b/.github/workflows/workflow.yaml
index 0c46f3dcd..92f0e334b 100644
--- a/.github/workflows/workflow.yaml
+++ b/.github/workflows/workflow.yaml
@@ -119,7 +119,7 @@ jobs:
                   continue
               else
                   echo "::group::Running $example_name"
-                  nix-shell --command 'bazel run --config=nix :hello'
+                  nix-shell --pure --keep GITHUB_STEP_SUMMARY --keep GITHUB_REPOSITORY --keep BZLMOD_ENABLED --keep BAZEL_NIX_REMOTE --command 'bazel run --config=nix :hello'
                   # TODO: all toolchains should run without Nixpkgs
               fi
               popd
diff --git a/examples/toolchains/cc/shell.nix b/examples/toolchains/cc/shell.nix
index a411bd037..c1ba098c6 100644
--- a/examples/toolchains/cc/shell.nix
+++ b/examples/toolchains/cc/shell.nix
@@ -1,3 +1,3 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.bazel_6 ]; }
+pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.nix pkgs.bazel_6 ]; }
diff --git a/examples/toolchains/cc_cross_osx_to_linux_amd64/shell.nix b/examples/toolchains/cc_cross_osx_to_linux_amd64/shell.nix
index a411bd037..c1ba098c6 100644
--- a/examples/toolchains/cc_cross_osx_to_linux_amd64/shell.nix
+++ b/examples/toolchains/cc_cross_osx_to_linux_amd64/shell.nix
@@ -1,3 +1,3 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.bazel_6 ]; }
+pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.nix pkgs.bazel_6 ]; }
diff --git a/examples/toolchains/cc_with_deps/shell.nix b/examples/toolchains/cc_with_deps/shell.nix
index a411bd037..c1ba098c6 100644
--- a/examples/toolchains/cc_with_deps/shell.nix
+++ b/examples/toolchains/cc_with_deps/shell.nix
@@ -1,3 +1,3 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.bazel_6 ]; }
+pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.nix pkgs.bazel_6 ]; }
diff --git a/examples/toolchains/go/shell.nix b/examples/toolchains/go/shell.nix
index a411bd037..a2206f727 100644
--- a/examples/toolchains/go/shell.nix
+++ b/examples/toolchains/go/shell.nix
@@ -1,3 +1,6 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.bazel_6 ]; }
+pkgs.mkShellNoCC {
+  nativeBuildInputs = [ pkgs.nix pkgs.bazel_6 ];
+  env.BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN = "1";
+}
diff --git a/examples/toolchains/java/shell.nix b/examples/toolchains/java/shell.nix
index a411bd037..a2206f727 100644
--- a/examples/toolchains/java/shell.nix
+++ b/examples/toolchains/java/shell.nix
@@ -1,3 +1,6 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.bazel_6 ]; }
+pkgs.mkShellNoCC {
+  nativeBuildInputs = [ pkgs.nix pkgs.bazel_6 ];
+  env.BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN = "1";
+}
diff --git a/examples/toolchains/nodejs/shell.nix b/examples/toolchains/nodejs/shell.nix
index 76c6390aa..d90f05da2 100644
--- a/examples/toolchains/nodejs/shell.nix
+++ b/examples/toolchains/nodejs/shell.nix
@@ -1,3 +1,3 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = with pkgs; [ bazel_6 ]; }
+pkgs.mkShellNoCC { nativeBuildInputs = with pkgs; [ nix bazel_6 ]; }
diff --git a/examples/toolchains/python/shell.nix b/examples/toolchains/python/shell.nix
index a411bd037..a2206f727 100644
--- a/examples/toolchains/python/shell.nix
+++ b/examples/toolchains/python/shell.nix
@@ -1,3 +1,6 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 
-pkgs.mkShellNoCC { nativeBuildInputs = [ pkgs.bazel_6 ]; }
+pkgs.mkShellNoCC {
+  nativeBuildInputs = [ pkgs.nix pkgs.bazel_6 ];
+  env.BAZEL_DO_NOT_DETECT_CPP_TOOLCHAIN = "1";
+}
diff --git a/examples/toolchains/rust/shell.nix b/examples/toolchains/rust/shell.nix
index 3d802ae9f..e98b5864c 100644
--- a/examples/toolchains/rust/shell.nix
+++ b/examples/toolchains/rust/shell.nix
@@ -1,6 +1,6 @@
 { pkgs ? import ./nixpkgs.nix { } }:
 with pkgs;
 mkShell {
-  nativeBuildInputs = [ bazel_6 git nix zlib libiconv ]
+  nativeBuildInputs = [ bazel_6 cacert git nix zlib libiconv ]
     ++ (lib.optional stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ]);
 }