diff --git a/.gitignore b/.gitignore
index ea8c4bf..5f3b1bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,7 @@
 /target
+
+# Nix: the symlink `nix build` drops, and direnv's local cache. flake.nix and
+# flake.lock ARE tracked — the lock is what pins the toolchain.
+/result
+/result-*
+/.direnv/
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..d339b4d
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1785989512,
+        "narHash": "sha256-HFQhkQcl5D1hUNoen3SGHCSFCt2Bg6uP+HgbrnA3InQ=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "445d861c6d31b4af0c79d8d4be2331f762a361d7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..974edb9
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,124 @@
+{
+  description = "PixelPass — P2P screen sharing CLI over iroh";
+
+  # Same channel the hosts run (nixos-config tracks nixos-26.05). The capture
+  # path talks to the live PipeWire daemon and the system PulseAudio server, so
+  # the client libraries here should come from the same release the server did.
+  inputs.nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
+
+  outputs =
+    { nixpkgs, ... }:
+    let
+      system = "x86_64-linux";
+      pkgs = nixpkgs.legacyPackages.${system};
+
+      # GStreamer is driven as a SUBPROCESS (gst-launch-1.0 / gst-inspect-1.0),
+      # not linked — there is no gstreamer-sys in Cargo.lock. So these are PATH
+      # dependencies at runtime rather than build inputs, and `deps.rs` refuses
+      # to start a share if any are missing.
+      gstPlugins = with pkgs; [
+        gst_all_1.gstreamer # gst-launch-1.0 / gst-inspect-1.0
+        gst_all_1.gst-plugins-base # videoscale (quality-preset downscale)
+        gst_all_1.gst-plugins-good # pulsesrc, ximagesrc
+        gst_all_1.gst-plugins-bad # h264parse, mpegtsmux, aacparse, vah264enc
+        gst_all_1.gst-plugins-ugly # x264enc (software-encode fallback)
+        gst_all_1.gst-libav # avenc_aac
+        pipewire # pipewiresrc (Wayland capture; ships in this pkg)
+      ];
+
+      # Opened with dlopen by the optional `--gui` front end (eframe/egui_glow/
+      # winit/glutin), never linked. Harmless for the default headless build.
+      guiRuntimeLibs = with pkgs; [
+        libGL
+        libxkbcommon
+        wayland
+        libx11
+        libxcursor
+        libxrandr
+        libxi
+      ];
+    in
+    {
+      devShells.${system}.default = pkgs.mkShell {
+        nativeBuildInputs =
+          with pkgs;
+          [
+            rustc
+            cargo
+            rustfmt
+            clippy
+
+            # Debian packaging (`cargo deb --no-build`). Build the binary
+            # inside a Debian/Ubuntu distrobox first so it links that distro's
+            # glibc — see the packaging notes in Cargo.toml.
+            cargo-deb
+
+            pkg-config
+
+            # pipewire-sys, libspa-sys and libpulse-sys all generate bindings
+            # with bindgen, which needs a real libclang at build time.
+            clang
+          ]
+          ++ gstPlugins
+          ++ [
+            # The rest of what `deps::check_host_binaries` looks for.
+            pkgs.pulseaudio # `pactl` (PipeWire stays the actual audio server)
+            pkgs.mpv # the viewer-side player
+            pkgs.xwininfo # the `--window` click-picker on X11
+
+            # `--doctor` shells out to vainfo to confirm the VA-API H.264
+            # ENCODE entrypoint really exists. Without it the report can only
+            # say "vah264enc and a render node are present" and has to leave
+            # hardware encode unconfirmed — which matters, because a GPU
+            # missing that entrypoint produces no video at all under the
+            # default encoder rather than failing loudly.
+            pkgs.libva-utils
+          ];
+
+        buildInputs =
+          with pkgs;
+          [
+            pipewire # pipewire-sys + libspa-sys
+            libpulseaudio # libpulse-sys: --repair reads/unloads Pulse modules
+
+            # x11rb is declared `default-features = false` here, which by itself
+            # is pure Rust — but Cargo unifies features across the graph, and
+            # arboard pulls x11rb with its `libxcb` feature on. That drags in
+            # as-raw-xcb-connection and makes the final link need -lxcb. It is a
+            # real link-time dependency of the binary, not an optional extra.
+            libxcb
+          ]
+          ++ guiRuntimeLibs;
+
+        # bindgen finds libclang through this variable specifically — having
+        # clang on PATH is not sufficient.
+        LIBCLANG_PATH = "${pkgs.llvmPackages.libclang.lib}/lib";
+
+        # NixOS keeps every GStreamer plugin in its own store path, so
+        # gst-launch-1.0 discovers them ONLY through this search path. Without
+        # it, pixelpass's `gst-inspect-1.0 --exists pipewiresrc` preflight fails
+        # even though the plugins are installed. Same reasoning as the
+        # GST_PLUGIN_SYSTEM_PATH_1_0 block in nixos-config hosts/darp5.
+        GST_PLUGIN_SYSTEM_PATH_1_0 = pkgs.lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" gstPlugins;
+
+        LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath guiRuntimeLibs;
+
+        # Only greet an interactive shell. shellHook also runs under
+        # `nix develop --command …`, where printing this would interleave the
+        # banner with the command's own output (and corrupt it outright for
+        # anything whose stdout is parsed, such as pixelpass's `--output json`).
+        shellHook = ''
+          if [ -t 1 ]; then
+            echo "pixelpass — rustc $(rustc --version | cut -d' ' -f2) / cargo $(cargo --version | cut -d' ' -f2)"
+            echo "  cargo build --release                 headless build (what peerspeak spawns)"
+            echo "  cargo build --release --features gui  with the egui front end"
+            echo "  cargo test                            unit + integration tests"
+            echo "  ./target/debug/pixelpass --doctor     verify this machine can host"
+            echo
+            echo "GStreamer, pactl, mpv and xwininfo are on PATH in this shell, so"
+            echo "capture works here without a system rebuild."
+          fi
+        '';
+      };
+    };
+}