diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 47980566d4..c984ff4d35 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -35,7 +35,7 @@ concurrency:
 
 jobs:
   build:
-    name: ${{ matrix.system }} / pinned Haskell compiler
+    name: ${{ matrix.system }} / ${{ matrix.target }} / pinned Haskell compiler
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 360
     strategy:
@@ -44,14 +44,28 @@ jobs:
         include:
           - system: x86_64-linux
             runner: ubuntu-24.04
+            target: native
+          - system: x86_64-linux
+            runner: ubuntu-24.04
+            target: android
+          - system: x86_64-linux
+            runner: ubuntu-24.04
+            target: windows
+          - system: x86_64-linux
+            runner: ubuntu-24.04
+            target: linux-static
           - system: aarch64-linux
             runner: ubuntu-24.04-arm
+            target: native
           - system: aarch64-darwin
             runner: macos-15
+            target: all
           - system: x86_64-darwin
             runner: macos-15-intel
+            target: all
     env:
       NIX_SYSTEM: ${{ matrix.system }}
+      NIX_TARGET: ${{ matrix.target }}
       NIX_BUILD_TIMEOUT: 7200
     steps:
       - uses: actions/checkout@v4
@@ -81,7 +95,7 @@ jobs:
       # failure and its flags intact; this is a separate diagnostic derivation.
       - name: Trace native Linux GHC phases after failure
         id: ghc_phase_trace
-        if: ${{ failure() && matrix.system == 'x86_64-linux' && steps.haskell_build.outcome == 'failure' }}
+        if: ${{ failure() && matrix.system == 'x86_64-linux' && matrix.target == 'native' && steps.haskell_build.outcome == 'failure' }}
         shell: bash
         run: |
           if [ -d "result-nix/$NIX_SYSTEM/lib:simplex-chat" ]; then
@@ -100,11 +114,12 @@ jobs:
         if: ${{ always() && steps.ghc_phase_trace.outputs.attempted == 'true' }}
         uses: actions/upload-artifact@v4
         with:
-          name: nix-ghc-phase-trace-${{ github.sha }}
+          name: nix-ghc-phase-trace-${{ matrix.system }}-${{ matrix.target }}-${{ github.sha }}
           path: native-linux-ghc-phase-trace.log
           if-no-files-found: warn
 
       - name: Check native CLI encryption and profile passwords
+        if: ${{ matrix.target == 'native' || matrix.target == 'all' }}
         run: python3 scripts/nix/smoke-cli.py "result-nix/$NIX_SYSTEM/exe:simplex-chat/bin/simplex-chat"
 
       - name: Collect library ZIPs and CLIs
@@ -124,6 +139,6 @@ jobs:
 
       - uses: actions/upload-artifact@v4
         with:
-          name: nix-${{ matrix.system }}-${{ github.sha }}
+          name: nix-${{ matrix.system }}-${{ matrix.target }}-${{ github.sha }}
           path: artifacts/
           if-no-files-found: error
diff --git a/scripts/nix/README.md b/scripts/nix/README.md
index c43a1b2f8d..4a12121a08 100644
--- a/scripts/nix/README.md
+++ b/scripts/nix/README.md
@@ -106,8 +106,12 @@ make nix-native NIX_ARGS=--dry-run
 ```
 
 `.github/workflows/nix.yml` runs these same outputs on Linux ARM64/x86_64 and
-Darwin ARM64/x86_64, with a six-hour job limit. It uploads the existing library ZIPs
-and CLIs under an artifact named for the source SHA. Each native CLI also runs
+Darwin ARM64/x86_64, with a six-hour limit per job. Its seven jobs cover all 21
+outputs once: x86_64 Linux runs `native`, `android`, `windows`, and `linux-static`
+separately; ARM64 Linux runs `native`; both Darwin hosts run `all`. A failed
+native Linux build therefore leaves the cross-build jobs running. Each job
+uploads its existing library ZIPs and CLIs under an artifact named for the build
+host, target group, and source SHA. Each native CLI also runs
 the encrypted-store and profile-password smoke test, which can be repeated with
 `python3 scripts/nix/smoke-cli.py result-nix/BUILD_SYSTEM/exe:simplex-chat/bin/simplex-chat`.