diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index c6b28a0..d5099a2 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -46,6 +46,14 @@ jobs:
       - name: Regenerate bun.nix from bun.lock
         run: nix run --accept-flake-config github:nix-community/bun2nix -- -o bun.nix
 
+      - name: Fail if committed bun.nix is out of date
+        run: |
+          if ! git diff --quiet -- bun.nix; then
+            echo '::error file=bun.nix::bun.nix is out of date! Run `nix run github:nix-community/bun2nix -- -o bun.nix` (requires Nix) and commit the result.'
+            git diff --stat -- bun.nix
+            exit 1
+          fi
+
       - name: Check flake
         run: nix flake check --accept-flake-config
 
@@ -55,9 +63,3 @@ jobs:
       - name: Build package
         if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v')
         run: nix build --print-build-logs --accept-flake-config
-
-      - name: Check for diffs
-        run: |
-          if ! git diff --quiet; then
-            echo "`bun.nix` is out of date! Run `nix run github:nix-community/bun2nix -- -o bun.nix` on a NixOS system to regenerate it!"
-          fi