diff --git a/.envrc b/.envrc
new file mode 100644
index 00000000..3550a30f
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/.gitignore b/.gitignore
index e9c63a57..c602b307 100644
--- a/.gitignore
+++ b/.gitignore
@@ -233,3 +233,10 @@ dkms.conf
 
 # --- End of C.gitignore ---
 tools/.ucd-cache/
+
+# --- Nix ---
+result
+result-*
+build/
+build-*/
+.direnv/
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 00000000..05da695d
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1791487292,
+        "narHash": "sha256-tqM7xDEsaeK1p6VvRygeZ9LkQRpUUkbRT02BHv6hnTM=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8edc0c72e3a38faf5434e40d1f19431125fe4b30",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "treefmt-nix": "treefmt-nix"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1773297127,
+        "narHash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "71b125cd05fbfd78cab3e070b73544abe24c5016",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 00000000..7acc26f5
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,111 @@
+{
+  description = "Lython: an LLVM/MLIR 23 based Python compiler toolchain";
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+
+    # Formatting tooling stays behind `formatter`/`checks` only. Referencing
+    # it from `packages` or `devShells` would make `nix run`/`nix build` fetch
+    # the tooling input again.
+    treefmt-nix.url = "github:numtide/treefmt-nix";
+    treefmt-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      treefmt-nix,
+      ...
+    }:
+    let
+      # nix-systems/default, inlined: four system names are not worth an input
+      # every `nix run` user would fetch.
+      systems = [
+        "aarch64-darwin"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "x86_64-linux"
+      ];
+
+      forAllSystems = nixpkgs.lib.genAttrs systems;
+
+      pkgsFor = system: import nixpkgs { inherit system; };
+
+      treefmtEvalFor =
+        system:
+        treefmt-nix.lib.evalModule (pkgsFor system) {
+          projectRootFile = "flake.nix";
+          programs.nixfmt.enable = true;
+          settings.formatter = { };
+        };
+    in
+    {
+      packages = forAllSystems (
+        system:
+        let
+          pkgs = pkgsFor system;
+          llvmPackages = pkgs.llvmPackages_23;
+          lython = pkgs.callPackage ./nix/build-lython.nix {
+            llvm = llvmPackages.llvm;
+            mlir = llvmPackages.mlir;
+            tblgen = llvmPackages.tblgen;
+          };
+        in
+        {
+          default = lython;
+          inherit lython;
+        }
+      );
+
+      formatter = forAllSystems (system: (treefmtEvalFor system).config.build.wrapper);
+
+      checks = forAllSystems (system: {
+        treefmt = (treefmtEvalFor system).config.build.check self;
+      });
+
+      devShells = forAllSystems (
+        system:
+        let
+          pkgs = pkgsFor system;
+          llvmPackages = pkgs.llvmPackages_23;
+        in
+        {
+          default = pkgs.mkShell {
+            packages = [
+              llvmPackages.llvm
+              llvmPackages.mlir
+              # mlir-tblgen and llvm-tblgen live only in `tblgen`; nixpkgs's
+              # mlir derivation does not install them into its `out`. Lython's
+              # CMake looks them up on PATH at configure time, so the
+              # devShell has to bring them in.
+              llvmPackages.tblgen
+              llvmPackages.clang
+              llvmPackages.lld
+              pkgs.cmake
+              pkgs.ninja
+              pkgs.gnumake
+              pkgs.pkg-config
+              pkgs.python3
+              pkgs.uv
+              pkgs.gdb
+              # `lyc` shells out to the clang in llvm23 for AOT and WASI
+              # linking; that clang locates the C++ runtime by finding gcc on
+              # PATH.
+              pkgs.gcc
+              pkgs.binutils
+            ];
+
+            LLVM_DIR = "${llvmPackages.llvm.dev}/lib/cmake/llvm";
+            MLIR_DIR = "${llvmPackages.mlir.dev}/lib/cmake/mlir";
+
+            shellHook = ''
+              export LLVM_DIR="${llvmPackages.llvm.dev}/lib/cmake/llvm"
+              export MLIR_DIR="${llvmPackages.mlir.dev}/lib/cmake/mlir"
+              echo "LLVM_DIR=$LLVM_DIR"
+              echo "MLIR_DIR=$MLIR_DIR"
+            '';
+          };
+        }
+      );
+    };
+}
diff --git a/nix/build-lython.nix b/nix/build-lython.nix
new file mode 100644
index 00000000..98a924e0
--- /dev/null
+++ b/nix/build-lython.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  ninja,
+  llvm,
+  mlir,
+  tblgen,
+  zlib,
+  zstd,
+  libxml2,
+  ncurses,
+}:
+
+stdenv.mkDerivation {
+  pname = "lython";
+  version = "0.1.0";
+
+  src = ../.;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    llvm
+    mlir
+    tblgen
+  ];
+
+  buildInputs = [
+    llvm
+    mlir
+    zlib
+    zstd
+    libxml2
+    ncurses
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+    "-DLLVM_DIR=${llvm.dev}/lib/cmake/llvm"
+    "-DMLIR_DIR=${mlir.dev}/lib/cmake/mlir"
+    # nixpkgs's mlir does not install mlir-tblgen into its `out`; the tablegen
+    # binary lives in `llvmPackages_23.tblgen`. Lython's CMake requires
+    # mlir-tblgen (and llvm-tblgen) at configure time, so we hand it the
+    # absolute paths here and skip the find_program search.
+    "-DLLVM_TABLEGEN_EXE=${tblgen}/bin/llvm-tblgen"
+    "-DMLIR_TABLEGEN_EXE=${tblgen}/bin/mlir-tblgen"
+    # tests/CMakeLists.txt pulls googletest through FetchContent, which has no
+    # network inside the Nix sandbox. The unit and golden suites are run from
+    # the devShell, where the fetch can reach the network.
+    "-DLYTHON_BUILD_TESTS=OFF"
+  ];
+
+  meta = {
+    description = "An LLVM/MLIR 23 based Python compiler toolchain";
+    homepage = "https://github.com/t3tra-dev/lython";
+    # Without this `nix run` looks for bin/lython (the pname) and fails; the
+    # installed binary is lyc.
+    mainProgram = "lyc";
+    platforms = [ "x86_64-linux" ];
+  };
+}