Found quite a trivial mitigation via using flake-compat for already locked nested flakes. That prevents from using "follows" directive in them, but that should be okay for our purposes.

Fenix removed naersk from flake deps, thus making this even more easy.

Created https://app.cachix.org/cache/pontem, so we can share build caches more easily. Will add workflow, that would require adding secrets to repo settings.