diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 63104c3..6610429 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,3 +33,22 @@ jobs:
         run: cargo build
       - name: Test
         run: cargo test
+
+  flake:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            experimental-features = nix-command flakes
+      - name: Check the flake evaluates
+        run: nix flake check --no-build
+      - name: Build
+        run: nix build .#default --print-build-logs
+      - name: Run
+        run: |
+          out=$(nix build .#default --no-link --print-out-paths)
+          ls "$out/bin" # both `bootit` and `it` must be installed
+          nix run .#default -- --version
diff --git a/README.md b/README.md
index 70f7b1c..bdfe5bb 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,28 @@ it windows # No sudo required!
 cargo install bootit
 ```
 
+### Nix
+Run it straight from the flake, no install step:
+```bash
+nix run github:mincomk/bootit -- scan
+```
+
+Or install it into your profile, which gives you both `bootit` and `it`:
+```bash
+nix profile install github:mincomk/bootit
+sudo bootit allow-non-root
+it windows
+```
+
+On NixOS you can also pull it from the flake as a package:
+```nix
+{
+  inputs.bootit.url = "github:mincomk/bootit";
+  # then, in your configuration:
+  environment.systemPackages = [ inputs.bootit.packages.${pkgs.system}.default ];
+}
+```
+
 ## Troubleshooting
 
 ### `sudo: bootit: command not found` after `cargo install`
diff --git a/flake.lock b/flake.lock
index 506fb87..886d2d9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,109 +1,24 @@
 {
   "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1770169865,
-        "narHash": "sha256-iPiy13xzDQ9GjpOez+NNIjh/qjl7i4RDf9dF2x5mF9I=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "8254ccf3b5b5131890ee073776f2e61c6d1e55d4",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "flake-utils": {
-      "inputs": {
-        "systems": "systems"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1744536153,
-        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
+        "lastModified": 1792502884,
+        "narHash": "sha256-IoNisKcGbUjdd45qCqywGMCYmZ5EnkxezvLII0FWwNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11",
+        "rev": "02c087f3fe673c9e317f206a627cb6b910336dbe",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
+        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "root": {
       "inputs": {
-        "crane": "crane",
-        "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
-      "locked": {
-        "lastModified": 1770260791,
-        "narHash": "sha256-ADTBfENFjRVDQMcCycyX/pAy6NFI/Ct6Mrar3gsmXI0=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "42ec85352e419e601775c57256a52f6d48a39906",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
+        "nixpkgs": "nixpkgs"
       }
     }
   },
diff --git a/flake.nix b/flake.nix
index 2fcbba2..c0adea2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,41 +1,64 @@
 {
-  description = "A very cool CLI tool";
-
-  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    flake-utils.url = "github:numtide/flake-utils";
-    rust-overlay.url = "github:oxalica/rust-overlay";
-    crane.url = "github:ipetkov/crane";
-  };
-
-  outputs = { self, nixpkgs, flake-utils, rust-overlay, crane }:
-    flake-utils.lib.eachDefaultSystem (system:
-      let
-        pkgs = import nixpkgs {
-          inherit system;
-          overlays = [ (import rust-overlay) ];
-        };
+  description = "bootit: a lightweight next-boot selector";
 
-        rustToolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
-        craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-        bootit = craneLib.buildPackage {
-          src = craneLib.cleanCargoSource (craneLib.path ./.);
-          buildInputs = with pkgs; [
-          ] ++ lib.optionals stdenv.isDarwin [
-            darwin.apple_sdk.frameworks.Security
-          ];
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+      forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+
+      version = (builtins.fromTOML (builtins.readFile ./Cargo.toml)).package.version;
+    in
+    {
+      packages = forAllSystems (pkgs: rec {
+        bootit = pkgs.rustPlatform.buildRustPackage {
+          pname = "bootit";
+          inherit version;
+          src = ./.;
+
+          cargoLock.lockFile = ./Cargo.lock;
+
+          # `it` is a second bin in the same crate; buildRustPackage installs
+          # every bin, so both `bootit` and `it` land in $out/bin.
+          meta = {
+            description = "Lightweight next-boot selector";
+            homepage = "https://github.com/mincomk/bootit";
+            license = pkgs.lib.licenses.mit;
+            mainProgram = "bootit";
+            platforms = pkgs.lib.platforms.linux;
+          };
         };
-      in
-      {
-        packages.default = bootit;
 
-        apps.default = flake-utils.lib.mkApp {
-          drv = bootit;
+        default = bootit;
+      });
+
+      apps = forAllSystems (pkgs: {
+        default = {
+          type = "app";
+          program = "${self.packages.${pkgs.stdenv.hostPlatform.system}.bootit}/bin/bootit";
+          meta.description = "Run bootit without installing it";
         };
+      });
 
-        devShells.default = pkgs.mkShell {
-          buildInputs = [ rustToolchain pkgs.cargo-edit pkgs.rust-analyzer ];
+      checks = forAllSystems (pkgs: {
+        bootit = self.packages.${pkgs.stdenv.hostPlatform.system}.bootit;
+      });
+
+      devShells = forAllSystems (pkgs: {
+        default = pkgs.mkShell {
+          packages = [
+            pkgs.cargo
+            pkgs.rustc
+            pkgs.rustfmt
+            pkgs.clippy
+            pkgs.rust-analyzer
+          ];
         };
       });
+    };
 }