diff --git a/AGENTS.md b/AGENTS.md
index cb634f1..a3f62a5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -71,10 +71,11 @@ This is a Phoenix Liveview monorepo, the blogging library is in blogex, the appl
 Main make targets:
 
 - `make setup` - one-time clone setup (and after any mix.exs gains a dep):
-  fetches Hex deps for both apps and the app's JS packages. Needs network -
-  run it yourself; agent sandboxes refuse installs. check/test/verify never
-  touch the network: they run a local `deps.check` guard that fails with a
-  pointer here when deps are missing.
+  fetches Hex deps for both apps, the app's JS packages, and compiles deps
+  (some deps fetch artifacts at compile time, e.g. the mdex_native NIF).
+  Needs network - run it yourself; agent sandboxes refuse installs.
+  check/test/verify never touch the network: they run a local `deps.check`
+  guard that fails with a pointer here when deps are missing.
 - `make check` - cheap static gate for both apps (no DB): app `credo --strict` +
   format **check** (`mix format --check-formatted`), blogex compile (warnings
   fatal) + format **check**, then `scripts/check-pins.sh`. It never rewrites
diff --git a/app/Makefile b/app/Makefile
index 106fe10..6bae07d 100644
--- a/app/Makefile
+++ b/app/Makefile
@@ -24,9 +24,17 @@ assets:
 	@test -f assets/node_modules/.package-lock.json || \
 		(echo "==> assets: npm install (first run)"; cd assets && npm install)
 
-# Sync dependencies (Hex packages + JS packages)
+# Sync dependencies (Hex packages + JS packages) and compile them. The compile
+# step is part of setup on purpose: some deps download artifacts at compile
+# time - rustler_precompiled fetches the mdex_native NIF from GitHub during
+# its first compile, and NimblePublisher pulls mdex_native into this app. Keep
+# that traffic in this explicit, user-run step so check/test/verify stay
+# offline even on a cold clone. (rustler_precompiled caches artifacts globally
+# in ~/Library/Caches/rustler_precompiled, so later test-env compiles find
+# them without network.)
 deps: assets
 	$(MISE_EXEC) mix deps.get
+	$(MISE_EXEC) mix deps.compile
 
 # Local, network-free guard: every package pinned in mix.lock must be present
 # in deps/. check, test and test.coverage depend on this instead of `deps`, so
diff --git a/blogex/Makefile b/blogex/Makefile
index 914d050..cf6db7f 100644
--- a/blogex/Makefile
+++ b/blogex/Makefile
@@ -22,9 +22,13 @@ check: deps.check compile format.check
 precommit:
 	$(MISE_EXEC) mix precommit
 
-# Sync dependencies
+# Sync dependencies and compile them: NimblePublisher pulls in mdex_native,
+# whose precompiled NIF downloads from GitHub at first compile. Keeping that
+# in `deps` (called by root `make setup`) keeps check/test/verify offline on
+# a cold clone.
 deps:
 	$(MISE_EXEC) mix deps.get
+	$(MISE_EXEC) mix deps.compile
 
 # Local, network-free guard: every package pinned in mix.lock must be present
 # in deps/. check, test and test.coverage depend on this instead of `deps`, so