diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c0b9a55f893ad16b93e869a7c94fb9b59ee1cccb..743c8ebf92d958541eb21006f8f2a701d132a079 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -19,18 +19,19 @@ stages:
 tag-it:
   stage: tag
   script:
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config user.email "${GITLAB_USER_EMAIL}"
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config user.name "${GITLAB_USER_NAME:-"Gitlab CI"}"
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config credential.helper '!f() { echo "username=gitlab-ci-token"; echo "password=${CI_JOB_TOKEN}"; }; f'
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config pull.rebase true
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config http.sslVerify "false"
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git remote set-url origin https://pad:${GITLAB_TOKEN}@${CI_REPOSITORY_URL#*@}
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git fetch --all --tags --unshallow
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git reset --hard origin/master
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git checkout $CI_COMMIT_REF_NAME
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git pull origin $CI_COMMIT_REF_NAME
-    - /nix/store/55i9ylml0w72j6qy33izic8ch14rslb0-version/bin/version auto --git --verbose 
-    - /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git push origin $CI_COMMIT_REF_NAME
+    - devenv shell ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config user.email "${GITLAB_USER_EMAIL}" ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config user.name "${GITLAB_USER_NAME:-"Gitlab CI"}" ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config credential.helper '!f() { echo "username=gitlab-ci-token"; echo "password=${CI_JOB_TOKEN}"; }; f' ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config pull.rebase true ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git config http.sslVerify "false" ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git remote set-url origin https://pad:${GITLAB_TOKEN}@${CI_REPOSITORY_URL#*@} ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git fetch --all --tags --unshallow ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git reset --hard origin/master ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git checkout $CI_COMMIT_REF_NAME ;\
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git pull origin $CI_COMMIT_REF_NAME ;\
+     /nix/store/55i9ylml0w72j6qy33izic8ch14rslb0-version/bin/version auto --git --verbose ;\ 
+     /nix/store/zrs710jpfn7ngy5z4c6rrwwjq33b2a0y-git-2.42.0/bin/git push origin $CI_COMMIT_REF_NAME 
   only:
     ## regex to x.y branches and master
     - master
@@ -48,5 +49,5 @@ release:
     # Disable shallow cloning so that goreleaser  can diff between tags to
     GIT_DEPTH: 0
   script:
-    - /nix/store/cgzhkcv3wvcd2zlblv4y0vhjvw479467-goreleaser-1.22.1/bin/goreleaser release --clean
+    - devenv shell /nix/store/cgzhkcv3wvcd2zlblv4y0vhjvw479467-goreleaser-1.22.1/bin/goreleaser release --clean
 
diff --git a/devenv.nix b/devenv.nix
index 8d65b12b724b5eb8e10035ffe8860e83ad1cc064..7f5e6de04589e2af59dc822d7ec4fa99dd905b33 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -61,18 +61,19 @@ tasks:
      tag-it:
        stage: tag
        script:
-         - ${pkgs.git}/bin/git config user.email "''${GITLAB_USER_EMAIL}"
-         - ${pkgs.git}/bin/git config user.name "''${GITLAB_USER_NAME:-"Gitlab CI"}"
-         - ${pkgs.git}/bin/git config credential.helper '!f() { echo "username=gitlab-ci-token"; echo "password=''${CI_JOB_TOKEN}"; }; f'
-         - ${pkgs.git}/bin/git config pull.rebase true
-         - ${pkgs.git}/bin/git config http.sslVerify "false"
-         - ${pkgs.git}/bin/git remote set-url origin https://pad:''${GITLAB_TOKEN}@''${CI_REPOSITORY_URL#*@}
-         - ${pkgs.git}/bin/git fetch --all --tags --unshallow
-         - ${pkgs.git}/bin/git reset --hard origin/master
-         - ${pkgs.git}/bin/git checkout $CI_COMMIT_REF_NAME
-         - ${pkgs.git}/bin/git pull origin $CI_COMMIT_REF_NAME
-         - ${inputs.version.defaultPackage."${builtins.currentSystem}"}/bin/version auto --git --verbose 
-         - ${pkgs.git}/bin/git push origin $CI_COMMIT_REF_NAME
+         - devenv shell ;\
+          ${pkgs.git}/bin/git config user.email "''${GITLAB_USER_EMAIL}" ;\
+          ${pkgs.git}/bin/git config user.name "''${GITLAB_USER_NAME:-"Gitlab CI"}" ;\
+          ${pkgs.git}/bin/git config credential.helper '!f() { echo "username=gitlab-ci-token"; echo "password=''${CI_JOB_TOKEN}"; }; f' ;\
+          ${pkgs.git}/bin/git config pull.rebase true ;\
+          ${pkgs.git}/bin/git config http.sslVerify "false" ;\
+          ${pkgs.git}/bin/git remote set-url origin https://pad:''${GITLAB_TOKEN}@''${CI_REPOSITORY_URL#*@} ;\
+          ${pkgs.git}/bin/git fetch --all --tags --unshallow ;\
+          ${pkgs.git}/bin/git reset --hard origin/master ;\
+          ${pkgs.git}/bin/git checkout $CI_COMMIT_REF_NAME ;\
+          ${pkgs.git}/bin/git pull origin $CI_COMMIT_REF_NAME ;\
+          ${inputs.version.defaultPackage."${builtins.currentSystem}"}/bin/version auto --git --verbose ;\ 
+          ${pkgs.git}/bin/git push origin $CI_COMMIT_REF_NAME 
        only:
          ## regex to x.y branches and master
          - master
@@ -90,7 +91,7 @@ tasks:
          # Disable shallow cloning so that goreleaser  can diff between tags to
          GIT_DEPTH: 0
        script:
-         - ${pkgs.goreleaser}/bin/goreleaser release --clean
+         - devenv shell ${pkgs.goreleaser}/bin/goreleaser release --clean
      
      '';
      };