diff --git a/flake.lock b/flake.lock
new file mode 100644
index 000000000..63d3fa653
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,44 @@
+{
+  "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1775036866,
+        "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 000000000..5ba151d2a
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,67 @@
+{
+  description = "Basic flake for Codename Engine, primarily useful for development";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-compat = {
+      url = "github:NixOS/flake-compat";
+      flake = false;
+    };
+  };
+
+  outputs =
+    { nixpkgs, ... }:
+    let
+      forEachSystem =
+        function:
+        nixpkgs.lib.genAttrs [ "aarch-darwin" "aarch64-linux" "x86_64-darwin" "x86_64-linux" ] (
+          system:
+          function (
+            nixpkgs.legacyPackages.${system}.extend (
+              final: prev: {
+                # We need to configure mbedtls_2 for Haxe manually, forcing a rebuild with different
+                # parameters.
+                mbedtls_2 = prev.mbedtls_2.overrideAttrs {
+                  # ...and that includes removing all known vulnerabilities. As of writing, the only
+                  # assigned vulnerability is that mbedtls_2 is no longer developed. Nix will refuse
+                  # to build packages if they have this value filled in.
+                  meta.knownVulnerabilities = [ ];
+                  # Without this, Nix will attempt to build the package and test it. The tests
+                  # themselves unfortunately fail at the moment, so we need to skip them to use
+                  # mbedtls_2 successfully.
+                  doCheck = false;
+                };
+              }
+            )
+          )
+        );
+    in
+    {
+      devShells = forEachSystem (pkgs: {
+        default = pkgs.mkShell rec {
+          name = "cne";
+          buildInputs = with pkgs; [
+            kdePackages.qttools
+            openal
+            libpulseaudio
+            libvlc
+            libGL
+            libx11
+            libxext
+            libxinerama
+            libxi
+            libxrandr
+            SDL2
+          ];
+          nativeBuildInputs = with pkgs; [
+            haxe
+            neko
+          ];
+          shellHook = ''
+            ./building/setup-unix.sh
+          '';
+          LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath buildInputs;
+        };
+      });
+    };
+}
diff --git a/shell.nix b/shell.nix
index 4cf3c006f..692cd4df8 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,42 +1,12 @@
-{ }:
-let
-  pkgs = import (builtins.fetchTarball {
-    url = "https://github.com/NixOS/nixpkgs/archive/c407032be28ca2236f45c49cfb2b8b3885294f7f.tar.gz";
-  }) { };
-
-  libs =
-    with pkgs;
-    [
-      SDL2
-      pkg-config
-      openal
-      alsa-lib
-      libvlc
-      libpulseaudio
-      libGL
-    ]
-    ++ (with xorg; [
-      libX11
-      libXext
-      libXinerama
-      libXi
-      libXrandr
-    ]);
-in
-pkgs.mkShell {
-  name = "CodenameEngine";
-
-  packages = with pkgs; [
-    haxe
-    neko
-    libsForQt5.qttools
-  ];
-
-  buildInputs = libs;
-
-  LD_LIBRARY_PATH = pkgs.lib.makeLibraryPath libs;
-
-  shellHook = ''
-    source update.sh
-  '';
-}
+(import (
+  let
+    lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+    nodeName = lock.nodes.root.inputs.flake-compat;
+  in
+  fetchTarball {
+    url =
+      lock.nodes.${nodeName}.locked.url
+        or "https://github.com/NixOS/flake-compat/archive/${lock.nodes.${nodeName}.locked.rev}.tar.gz";
+    sha256 = lock.nodes.${nodeName}.locked.narHash;
+  }
+) { src = ./.; }).shellNix