diff --git a/.github/workflows/javascript.yml b/.github/workflows/javascript.yml
index d47a8251e..a65b9040c 100644
--- a/.github/workflows/javascript.yml
+++ b/.github/workflows/javascript.yml
@@ -8,12 +8,6 @@ on:
   pull_request:
     paths:
       - payjoin-ffi/**
-env:
-  # Override the value from the rust-toolchain file
-  # This is necessary because even though the correct toolchain
-  # is explicitly specified for the rust-toolchain action,
-  # rustup honors the rust-toolchain file over the default
-  RUSTUP_TOOLCHAIN: 1.85
 
 jobs:
   build-js-and-test:
@@ -29,22 +23,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Rust 1.85.0
-        uses: dtolnay/rust-toolchain@1.85.0
-
       - name: "Use cache"
         uses: Swatinem/rust-cache@v2
 
-      - name: Install Node
-        uses: actions/setup-node@v6
-
-      - name: Install llvm
-        if: matrix.os == 'macos-latest'
-        run: brew install llvm
+      - name: "Install nix"
+        uses: DeterminateSystems/determinate-nix-action@main
 
-      # 0.2.109+ requires rustc 1.88 (via time crate).
-      - name: Install wasm-bindgen
-        run: cargo install --locked wasm-bindgen-cli --version 0.2.108
+      - name: "Use nix cache"
+        uses: DeterminateSystems/magic-nix-cache-action@main
 
       - name: "Build and test"
-        run: bash ./contrib/test.sh
+        run: nix develop .#msrv -c ./contrib/test.sh
diff --git a/flake.nix b/flake.nix
index aa2f95097..4715478a3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -89,17 +89,19 @@
                   "rustfmt"
                   "llvm-tools-preview"
                 ];
-                # Targets needed by payjoin-ffi/python/scripts/generate_bindings.sh
+                # Targets needed by payjoin-ffi/{python,javascript}/scripts/generate_bindings.sh
                 # so cargo can build per-arch artifacts under nix (rustup target add
                 # is a no-op against a nix-provided toolchain).
-                targets =
-                  pkgs.lib.optionals pkgs.stdenv.isDarwin [
-                    "aarch64-apple-darwin"
-                    "x86_64-apple-darwin"
-                  ]
-                  ++ pkgs.lib.optionals pkgs.stdenv.isLinux [
-                    "x86_64-unknown-linux-gnu"
-                  ];
+                targets = [
+                  "wasm32-unknown-unknown"
+                ]
+                ++ pkgs.lib.optionals pkgs.stdenv.isDarwin [
+                  "aarch64-apple-darwin"
+                  "x86_64-apple-darwin"
+                ]
+                ++ pkgs.lib.optionals pkgs.stdenv.isLinux [
+                  "x86_64-unknown-linux-gnu"
+                ];
               }
             )
             {
@@ -290,6 +292,14 @@
                 cargo-fuzz
                 bzip2 # needed for some machines to have access to libzip at runtime
                 codespell
+                # secp256k1-sys build.rs invokes cc-rs for the wasm32-unknown-unknown
+                # target; cc-rs defaults to clang for wasm and needs llvm-ar.
+                llvmPackages.clang-unwrapped
+                llvmPackages.bintools-unwrapped
+                lld
+                # Version must match the wasm-bindgen crate locked in
+                # payjoin-ffi/javascript/rust_modules/wasm/Cargo.lock.
+                wasm-bindgen-cli_0_2_108
               ]
               ++ pkgs.lib.optionals (!pkgs.stdenv.isDarwin) [
                 cargo-llvm-cov
@@ -298,6 +308,8 @@
             BITCOIND_SKIP_DOWNLOAD = 1;
             DOTNET_ROOT = "${dotnetSdk}/share/dotnet";
             DOTNET_CLI_TELEMETRY_OPTOUT = "1";
+            CC_wasm32_unknown_unknown = "${pkgs.llvmPackages.clang-unwrapped}/bin/clang";
+            AR_wasm32_unknown_unknown = "${pkgs.llvmPackages.bintools-unwrapped}/bin/llvm-ar";
           }
         ) craneLibVersions;
 
diff --git a/payjoin-ffi/javascript/scripts/generate_bindings.sh b/payjoin-ffi/javascript/scripts/generate_bindings.sh
index 347c6ee67..1dbbbc5a1 100755
--- a/payjoin-ffi/javascript/scripts/generate_bindings.sh
+++ b/payjoin-ffi/javascript/scripts/generate_bindings.sh
@@ -6,7 +6,7 @@ echo "Running on $OS"
 
 npm --version
 
-if [[ $OS == "Darwin" ]]; then
+if [[ $OS == "Darwin" && -z ${IN_NIX_SHELL:-} ]]; then
     # TODO: check if brew & llvm are installed
     LLVM_PREFIX=$(brew --prefix llvm)
     export AR="$LLVM_PREFIX/bin/llvm-ar"