diff --git a/.github/workflows/nix-action-9.0.yml b/.github/workflows/nix-action-9.0.yml
index 8007929a6c..364361e6fd 100644
--- a/.github/workflows/nix-action-9.0.yml
+++ b/.github/workflows/nix-action-9.0.yml
@@ -1037,3 +1037,5 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
diff --git a/.github/workflows/nix-action-9.1.yml b/.github/workflows/nix-action-9.1.yml
index 2de267046a..f4824b8176 100644
--- a/.github/workflows/nix-action-9.1.yml
+++ b/.github/workflows/nix-action-9.1.yml
@@ -1037,3 +1037,5 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
diff --git a/.github/workflows/nix-action-9.2.yml b/.github/workflows/nix-action-9.2.yml
index e9b8f41159..f457f02ced 100644
--- a/.github/workflows/nix-action-9.2.yml
+++ b/.github/workflows/nix-action-9.2.yml
@@ -684,6 +684,77 @@ jobs:
       name: Building/fetching current CI target
       run: NIXPKGS_ALLOW_UNFREE=1 nix-build --no-out-link --argstr bundle "9.2" 
         --argstr job "mathcomp-experimental-reals"
+  mathcomp-infotheo:
+    needs:
+    - coq
+    - mathcomp-analysis-stdlib
+    - interval
+    runs-on: ubuntu-latest
+    steps:
+    - name: Determine which commit to initially checkout
+      run: "if [ ${{ github.event_name }} = \"push\" ]; then\n  echo \"target_commit=${{
+        github.sha }}\" >> $GITHUB_ENV\nelse\n  echo \"target_commit=${{ github.event.pull_request.head.sha
+        }}\" >> $GITHUB_ENV\nfi\n"
+    - name: Git checkout
+      uses: actions/checkout@v7
+      with:
+        allow-unsafe-pr-checkout: true
+        fetch-depth: 0
+        ref: ${{ env.target_commit }}
+    - name: Determine which commit to test
+      run: "if [ ${{ github.event_name }} = \"push\" ]; then\n  echo \"tested_commit=${{
+        github.sha }}\" >> $GITHUB_ENV\nelse\n  merge_commit=$(git ls-remote ${{ github.event.repository.html_url
+        }} refs/pull/${{ github.event.number }}/merge | cut -f1)\n  mergeable=$(git
+        merge --no-commit --no-ff ${{ github.event.pull_request.base.sha }} > /dev/null
+        2>&1; echo $?; git merge --abort > /dev/null 2>&1 || true)\n  if [ -z \"$merge_commit\"\
+        \ -o \"x$mergeable\" != \"x0\" ]; then\n    echo \"tested_commit=${{ github.event.pull_request.head.sha
+        }}\" >> $GITHUB_ENV\n  else\n    echo \"tested_commit=$merge_commit\" >> $GITHUB_ENV\n\
+        \  fi\nfi\n"
+    - name: Git checkout
+      uses: actions/checkout@v7
+      with:
+        allow-unsafe-pr-checkout: true
+        fetch-depth: 0
+        ref: ${{ env.tested_commit }}
+    - name: Cachix install
+      uses: cachix/install-nix-action@v31
+      with:
+        nix_path: nixpkgs=channel:nixpkgs-unstable
+    - name: Cachix setup math-comp
+      uses: cachix/cachix-action@v16
+      with:
+        authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
+        extraPullNames: coq, coq-community
+        name: math-comp
+    - id: stepGetDerivation
+      name: Getting derivation for current job (mathcomp-infotheo)
+      run: "NIXPKGS_ALLOW_UNFREE=1 nix-build --no-out-link \\\n   --argstr bundle
+        \"9.2\" --argstr job \"mathcomp-infotheo\" \\\n   --dry-run 2> err > out ||
+        (touch fail; true)\ncat out err\nif [ -e fail ]; then echo \"Error: getting
+        derivation failed\"; exit 1; fi\n"
+    - id: stepCheck
+      name: Checking presence of CI target for current job
+      run: "if $(cat out err | grep -q \"built:\") ; then\n  echo \"CI target needs
+        actual building\"\n  if $(cat out err | grep -q \"derivations will be built:\"\
+        ) ; then\n    echo \"waiting a bit for derivations that should be in cache\"\
+        \n    sleep 30\n  fi\nelse\n  echo \"CI target already built\"\n  echo \"\
+        status=fetched\" >> $GITHUB_OUTPUT\nfi\n"
+    - if: steps.stepCheck.outputs.status != 'fetched'
+      name: 'Building/fetching previous CI target: coq'
+      run: NIXPKGS_ALLOW_UNFREE=1 nix-build --no-out-link --argstr bundle "9.2" 
+        --argstr job "coq"
+    - if: steps.stepCheck.outputs.status != 'fetched'
+      name: 'Building/fetching previous CI target: mathcomp-analysis-stdlib'
+      run: NIXPKGS_ALLOW_UNFREE=1 nix-build --no-out-link --argstr bundle "9.2" 
+        --argstr job "mathcomp-analysis-stdlib"
+    - if: steps.stepCheck.outputs.status != 'fetched'
+      name: 'Building/fetching previous CI target: interval'
+      run: NIXPKGS_ALLOW_UNFREE=1 nix-build --no-out-link --argstr bundle "9.2" 
+        --argstr job "interval"
+    - if: steps.stepCheck.outputs.status != 'fetched'
+      name: Building/fetching current CI target
+      run: NIXPKGS_ALLOW_UNFREE=1 nix-build --no-out-link --argstr bundle "9.2" 
+        --argstr job "mathcomp-infotheo"
   mathcomp-reals:
     needs:
     - rocq-core
@@ -899,3 +970,5 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
diff --git a/.github/workflows/nix-action-9.3.yml b/.github/workflows/nix-action-9.3.yml
index aee3d6b1da..ca68eb75f5 100644
--- a/.github/workflows/nix-action-9.3.yml
+++ b/.github/workflows/nix-action-9.3.yml
@@ -817,3 +817,5 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
diff --git a/.github/workflows/nix-action-master.yml b/.github/workflows/nix-action-master.yml
index 9314f61a53..54e4878807 100644
--- a/.github/workflows/nix-action-master.yml
+++ b/.github/workflows/nix-action-master.yml
@@ -1219,3 +1219,5 @@ on:
   push:
     branches:
     - master
+permissions:
+  contents: read
diff --git a/.nix/config.nix b/.nix/config.nix
index 6e76497798..0d5b121ab7 100644
--- a/.nix/config.nix
+++ b/.nix/config.nix
@@ -77,7 +77,6 @@ in {
       coq.override.version = "9.2";
       mathcomp.override.version = "2.6.0";
       ssprove.job = false;  # not yet available for 9.2
-      mathcomp-infotheo.job = false;  # interval not yet available for 9.2
     };
   };
 
diff --git a/.nix/coq-nix-toolbox.nix b/.nix/coq-nix-toolbox.nix
index 71ff6cb1b7..226b923ed9 100644
--- a/.nix/coq-nix-toolbox.nix
+++ b/.nix/coq-nix-toolbox.nix
@@ -1 +1 @@
-"f0c74efcec0d8657e1d5bcc6fd431b7caee1e43d"
+"8634339408b42cd68b7123129cc1a34e9db9829c"