diff --git a/.claude/skills/xce-build/SKILL.md b/.claude/skills/xce-build/SKILL.md
index 7ffa7c42..65305556 100644
--- a/.claude/skills/xce-build/SKILL.md
+++ b/.claude/skills/xce-build/SKILL.md
@@ -40,13 +40,15 @@ This is a judgment call, not a rigid formula — if you notice other heavy build
 
 Examples: `/xce-build controller` (ASAN), `/xce-build controller debug` (gdb/core build), `/xce-build all release`, `/xce-build xceadmin` (build + test + wheel, any profile arg is accepted and ignored), `/xce-build xceadmin --incremental` (same, but keeps other components already built in the same dir).
 
+`xce-build.sh` self-wraps into the hermetic nix dev shell (checks `IN_NIX_SHELL`, re-execs itself under `nix develop` if unset) — invoke it directly, no manual `nix develop ./src --command` wrapper needed.
+
 Run (substituting the parsed component/profile/build_dir, and the `--jobs N` value computed per the section above; omit trailing empty ones; append `--incremental` at the end, anywhere, when requested):
 
 ```bash
-nix develop ./src --command bash src/tools/xce-build.sh <component> <profile> <build_dir> --jobs <N> [--incremental]
+bash src/tools/xce-build.sh <component> <profile> <build_dir> --jobs <N> [--incremental]
 ```
 
-e.g. for `/xce-build controller` with a computed `N=14`: `nix develop ./src --command bash src/tools/xce-build.sh controller --jobs 14`. For `/xce-build xceadmin --incremental` with `N=8`: `nix develop ./src --command bash src/tools/xce-build.sh xceadmin --jobs 8 --incremental` (`--jobs` and `--incremental` are flags, stripped out from any position before the remaining words are parsed positionally — they don't need to follow profile/build_dir).
+e.g. for `/xce-build controller` with a computed `N=14`: `bash src/tools/xce-build.sh controller --jobs 14`. For `/xce-build xceadmin --incremental` with `N=8`: `bash src/tools/xce-build.sh xceadmin --jobs 8 --incremental` (`--jobs` and `--incremental` are flags, stripped out from any position before the remaining words are parsed positionally — they don't need to follow profile/build_dir).
 
 ## Run the build via Bash `run_in_background`, not an Agent-tool subagent
 
@@ -55,7 +57,7 @@ e.g. for `/xce-build controller` with a computed `N=14`: `nix develop ./src --co
 Instead, run the resolved command directly with the **Bash tool's own `run_in_background: true`**, from the current session, and let the harness's own task-notification mechanism — not a subagent's self-report — tell you when it's done. This has been empirically proven reliable in this exact repo (2026-09-03: both a full `all debug` build and a `controller` ASAN rebuild were driven this way, and each genuinely blocked until real completion).
 
 ```bash
-nix develop ./src --command bash src/tools/xce-build.sh <component> <profile> <build_dir> --jobs <N> [--incremental] \
+bash src/tools/xce-build.sh <component> <profile> <build_dir> --jobs <N> [--incremental] \
   > <scratchpad>/xce-build-<component>-<profile>.log 2>&1; \
   echo "EXIT_CODE=$?" >> <scratchpad>/xce-build-<component>-<profile>.log
 ```