diff --git a/.github/actions/setup-nix/action.yml b/.github/actions/setup-nix/action.yml
new file mode 100644
index 000000000..abe25fca5
--- /dev/null
+++ b/.github/actions/setup-nix/action.yml
@@ -0,0 +1,14 @@
+name: Setup Nix
+description: Install Nix and enable the shared binary cache for flake-based CI jobs
+
+runs:
+  using: composite
+  steps:
+    - name: Install Nix
+      uses: DeterminateSystems/nix-installer-action@v23
+      with:
+        extra-conf: |
+          experimental-features = nix-command flakes
+
+    - name: Enable Magic Nix Cache
+      uses: DeterminateSystems/magic-nix-cache-action@v15
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..868b55902
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,54 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  flake:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Run flake checks
+        run: nix flake check --print-build-logs
+
+  rust:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Check formatting
+        run: nix develop --command cargo fmt --all --check
+      - name: Run clippy
+        run: nix develop --command cargo clippy --locked --workspace --all-targets -- -D warnings
+      - name: Run workspace tests
+        run: nix develop --command cargo test --locked --workspace
+
+  web:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Verify wasm target
+        run: nix develop --command rustc --print target-libdir --target wasm32-unknown-unknown > /dev/null
+      - name: Build web bundle
+        run: nix develop --command trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+      - name: Validate website assembly
+        run: nix develop --command python3 scripts/test_site.py
+
+  release-automation:
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.github/actions/setup-nix
+      - name: Test release automation
+        run: nix develop --command python3 scripts/test_release.py
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 9f9c4f4bd..f5005767f 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -39,6 +39,7 @@ jobs:
     steps:
       - name: Resolve release source
         id: source
+        shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag || github.event.release.tag_name }}
@@ -70,10 +71,13 @@ jobs:
           # release tag; a shallow clone would label the build `+g<hash>`.
           fetch-depth: 0
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Validate release version
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           git merge-base --is-ancestor "$RELEASE_TAG" HEAD
           if [ -f scripts/release.py ]; then
             python3 scripts/release.py versions --tag "$RELEASE_TAG"
@@ -81,63 +85,64 @@ jobs:
             VERSION=$(sed -n 's/^version = "\([^"]*\)"/\1/p' Cargo.toml | head -1)
             test "v$VERSION" = "$RELEASE_TAG"
           fi
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          targets: wasm32-unknown-unknown
-
-      - uses: Swatinem/rust-cache@v2
-
-      - name: Install trunk
-        uses: taiki-e/install-action@v2
-        with:
-          tool: trunk
-
-      - name: Read wasm-bindgen version
-        id: wasm-bindgen-version
-        shell: bash
-        run: |
-          VERSION=$(sed -n '/name = "wasm-bindgen"/{n;s/version = "\(.*\)"/\1/p;q;}' Cargo.lock)
-          test -n "$VERSION"
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-
-      - name: Install wasm-bindgen CLI
-        uses: taiki-e/install-action@v2
-        with:
-          tool: wasm-bindgen@${{ steps.wasm-bindgen-version.outputs.version }}
+      - name: Verify wasm target
+        run: nix develop --command rustc --print target-libdir --target wasm32-unknown-unknown > /dev/null
 
       - name: Build web bundle
-        run: trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+        run: nix develop --command trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
 
       - name: Check out current website
         uses: actions/checkout@v4
         with:
           ref: main
-          path: website
+          path: website-source
 
       - name: Validate website
-        working-directory: website
-        run: python3 scripts/test_site.py
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website-source"
+          python3 scripts/test_site.py
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Assemble landing page
-        working-directory: website
-        run: sh scripts/assemble-site.sh "$GITHUB_WORKSPACE/dist"
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website-source"
+          sh "$GITHUB_WORKSPACE/website-source/scripts/assemble-site.sh" "$GITHUB_WORKSPACE/dist"
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Record website source
-        working-directory: website
-        run: git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"
+        run: |
+          SCRIPT=$(cat <<'EOF'
+          cd "$GITHUB_WORKSPACE/website-source"
+          git rev-parse HEAD > "$GITHUB_WORKSPACE/dist/site-version.txt"
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Record release version and source
         env:
           RELEASE_TAG: ${{ steps.source.outputs.tag }}
           RELEASE_COMMIT: ${{ steps.source.outputs.commit }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           jq -n --arg version "${RELEASE_TAG#v}" --arg commit "$RELEASE_COMMIT" \
             '{version: $version, commit: $commit}' > dist/app/release.json
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # GitHub Pages runs Jekyll, which ignores files; opt out so the
       # wasm-bindgen output is served verbatim.
-      - run: touch dist/.nojekyll
+      - run: nix develop --command touch dist/.nojekyll
 
       # The web app can't call the Patreon API directly (CORS + the token would
       # be exposed in the bundle), so generate the supporters list server-side
@@ -147,6 +152,7 @@ jobs:
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           python3 - <<'PY'
           import json
           import os
@@ -256,12 +262,15 @@ jobs:
           )
           print(f"supporters: {len(supporters)}")
           PY
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # Publish separate light/dark charts for stars and release downloads.
       - name: Generate project growth charts
         env:
           GITHUB_TOKEN: ${{ secrets.OCS_GITHUB_TOKEN }}
-        run: python3 website/scripts/generate-star-history.py --output-dir dist
+        run: nix develop --command python3 website-source/scripts/generate-star-history.py --output-dir dist
 
       # Browsers cannot reliably fetch YouTube playlist/oEmbed responses because
       # of CORS. Build a same-origin listing and thumbnail directory for the
@@ -269,6 +278,7 @@ jobs:
       # unavailable during deployment.
       - name: Generate videos.json
         run: |
+          SCRIPT=$(cat <<'EOF'
           python3 - <<'PY'
           import json
           import re
@@ -326,12 +336,16 @@ jobs:
 
           print(f"videos: {len(json.loads(output.read_text(encoding='utf-8')))}")
           PY
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       # Publish a public snapshot of GitHub discussions.
       - name: Generate discussions.json
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           QUERY='
             query($owner: String!, $name: String!) {
               repository(owner: $owner, name: $name) {
@@ -376,6 +390,9 @@ jobs:
                   })' \
             > dist/app/discussions.json
           echo "discussions: $(jq 'length' dist/app/discussions.json)"
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - uses: actions/upload-pages-artifact@v3
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0b033babc..cbfd40f76 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,29 +43,21 @@ jobs:
           # release tag; a shallow clone would label the build `+g<hash>`.
           fetch-depth: 0
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Validate package versions
         id: version
         shell: bash
-        run: python3 scripts/release.py versions --tag "$RELEASE_TAG"
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install dependencies
-        run: |
-          sudo apt-get update -q
-          sudo apt-get install -y \
-            libgl1-mesa-dev libx11-dev libxcursor-dev libxi-dev libxrandr-dev \
-            libxkbcommon-dev libwayland-dev libfontconfig1-dev libfreetype6-dev \
-            librsvg2-bin fuse libfuse2
+        run: nix develop --command python3 scripts/release.py versions --tag "$RELEASE_TAG"
 
       - name: Build
         env:
           OCS_PATREON_TOKEN: ${{ secrets.OCS_PATREON_TOKEN }}
-        run: cargo build --locked --release
+        run: nix develop --command cargo build --locked --release
 
       - name: Prepare AppDir
         run: |
+          SCRIPT=$(cat <<'EOF'
           mkdir -p AppDir/usr/bin
           mkdir -p AppDir/usr/share/applications
           mkdir -p AppDir/usr/share/icons/hicolor/256x256/apps
@@ -75,9 +67,12 @@ jobs:
           cp packaging/io.github.HakanSeven12.OpenCadStudio.metainfo.xml AppDir/usr/share/metainfo/
           rsvg-convert -w 256 -h 256 assets/logo.svg \
             -o AppDir/usr/share/icons/hicolor/256x256/apps/io.github.HakanSeven12.OpenCadStudio.png
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Pack shared Linux payload
-        run: tar -C AppDir -czf linux-payload.tar.gz usr
+        run: nix develop --command tar -C AppDir -czf linux-payload.tar.gz usr
 
       - name: Upload shared Linux payload
         uses: actions/upload-artifact@v4
@@ -89,28 +84,40 @@ jobs:
 
       - name: Download linuxdeploy
         run: |
+          SCRIPT=$(cat <<'EOF'
           wget -q https://github.com/linuxdeploy/linuxdeploy/releases/download/continuous/linuxdeploy-x86_64.AppImage
           chmod +x linuxdeploy-x86_64.AppImage
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Build AppImage
         env:
           APPIMAGE_EXTRACT_AND_RUN: 1
         run: |
+          SCRIPT=$(cat <<'EOF'
           ./linuxdeploy-x86_64.AppImage \
             --appdir AppDir \
             --desktop-file AppDir/usr/share/applications/io.github.HakanSeven12.OpenCadStudio.desktop \
             --icon-file AppDir/usr/share/icons/hicolor/256x256/apps/io.github.HakanSeven12.OpenCadStudio.png \
             --output appimage
           mv Open*CAD*Studio*.AppImage OpenCADStudio.AppImage
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Upload AppImage to release
         if: env.RELEASE_TAG != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           ASSET=OpenCADStudio-${{ env.RELEASE_TAG }}-linux-x86_64.AppImage
           mv OpenCADStudio.AppImage "$ASSET"
           gh release upload ${{ env.RELEASE_TAG }} "$ASSET" --clobber --repo ${{ github.repository }}
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
   build-snap:
     needs: build-appimage
@@ -134,10 +141,12 @@ jobs:
           # release tag; a shallow clone would label the build `+g<hash>`.
           fetch-depth: 0
 
+      - uses: ./.github/actions/setup-nix
+
       - name: Validate package versions
         id: version
         shell: bash
-        run: python3 scripts/release.py versions --tag "$RELEASE_TAG"
+        run: nix develop --command python3 scripts/release.py versions --tag "$RELEASE_TAG"
 
       - name: Download shared Linux payload
         uses: actions/download-artifact@v4
@@ -145,48 +154,68 @@ jobs:
           name: linux-payload
           path: .
 
-      - name: Set package version
+      - name: Prepare snap project
         id: package
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          sed -i "s/^version: .*/version: '$VERSION'/" snap/snapcraft.yaml
+          SCRIPT=$(cat <<'EOF'
+          test -n "$VERSION"
+          rm -rf .snap-build
+          mkdir -p .snap-build
+          shopt -s dotglob
+          for entry in * .*; do
+            case "$entry" in
+              .|..|.git|.snap-build) continue ;;
+            esac
+            cp -a "$entry" .snap-build/
+          done
+          sed -i "s/^version: .*/version: '$VERSION'/" .snap-build/snap/snapcraft.yaml
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Build snap
         id: snapcraft
         uses: snapcore/action-build@v1
+        with:
+          path: .snap-build
 
       - name: Normalize snap package name
-        id: snap_package
+        id: snap_asset
         env:
           SNAP: ${{ steps.snapcraft.outputs.snap }}
           VERSION: ${{ steps.package.outputs.version }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           PACKAGE="OpenCADStudio-v${VERSION}-linux-x86_64.snap"
           mv "$SNAP" "$PACKAGE"
           echo "snap=$PACKAGE" >> "$GITHUB_OUTPUT"
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
       - name: Upload snap to release
         if: env.RELEASE_TAG != ''
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SNAP: ${{ steps.snap_package.outputs.snap }}
-        run: gh release upload "${{ env.RELEASE_TAG }}" "$SNAP" --clobber
+          SNAP: ${{ steps.snap_asset.outputs.snap }}
+        run: nix develop --command gh release upload "${{ env.RELEASE_TAG }}" "$SNAP" --clobber --repo ${{ github.repository }}
 
       - name: Upload snap as workflow artifact
         if: env.RELEASE_TAG == ''
         uses: actions/upload-artifact@v4
         with:
           name: OpenCADStudio-v${{ steps.package.outputs.version }}-linux-x86_64-snap
-          path: ${{ steps.snap_package.outputs.snap }}
+          path: ${{ steps.snap_asset.outputs.snap }}
           if-no-files-found: error
 
       - name: Publish snap to edge
         if: env.RELEASE_TAG != '' && env.SNAPCRAFT_STORE_CREDENTIALS != ''
         uses: snapcore/action-publish@v1
         with:
-          snap: ${{ steps.snap_package.outputs.snap }}
+          snap: ${{ steps.snap_asset.outputs.snap }}
           release: edge
 
   build-windows:
@@ -546,7 +575,8 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.commit || github.sha }}
+      - uses: ./.github/actions/setup-nix
       - name: Verify native release assets and notes
         env:
           GH_TOKEN: ${{ github.token }}
-        run: python3 scripts/release.py verify-native --tag "$RELEASE_TAG"
+        run: nix develop --command python3 scripts/release.py verify-native --tag "$RELEASE_TAG"
diff --git a/.github/workflows/weekly-release.yml b/.github/workflows/weekly-release.yml
index f8ef0b1dc..b06abf3f8 100644
--- a/.github/workflows/weekly-release.yml
+++ b/.github/workflows/weekly-release.yml
@@ -34,19 +34,24 @@ jobs:
         with:
           ref: main
           fetch-depth: 0
+      - uses: ./.github/actions/setup-nix
       - name: Validate release automation
-        run: python3 scripts/test_release.py
+        run: nix develop --command python3 scripts/test_release.py
       - name: Prepare release and verify published notes
         id: release
         env:
           GH_TOKEN: ${{ github.token }}
           PUBLISH: ${{ github.event_name == 'schedule' || inputs.publish }}
         run: |
+          SCRIPT=$(cat <<'EOF'
           if [ "$PUBLISH" = true ]; then
             python3 scripts/release.py prepare --publish
           else
             python3 scripts/release.py prepare
           fi
+          EOF
+          )
+          nix develop --command bash --noprofile --norc -euo pipefail -c "$SCRIPT"
 
   # GITHUB_TOKEN releases do not trigger release events, so call both builds.
   web:
diff --git a/README.md b/README.md
index 38413d747..c764fa8f6 100644
--- a/README.md
+++ b/README.md
@@ -131,6 +131,26 @@ Change the language from the application settings. The browser version also uses
 
 ## Build from source
 
+### Nix
+
+The GitHub workflows use the repository flake for a reproducible Rust, web, and automation toolchain. To match CI locally:
+
+```bash
+git clone https://github.com/HakanSeven12/OpenCADStudio.git
+cd OpenCADStudio
+nix develop
+```
+
+From that shell, run the same commands CI does, for example:
+
+```bash
+cargo fmt --all --check
+cargo test --locked --workspace
+trunk build --locked --release --public-url /app/ --dist dist/app --html-output index.html web-app.html
+python3 scripts/test_site.py
+python3 scripts/test_release.py
+```
+
 ### Desktop
 
 Requirements:
diff --git a/flake.nix b/flake.nix
index 89610a0b6..93ecb62e6 100644
--- a/flake.nix
+++ b/flake.nix
@@ -132,9 +132,15 @@
               fontconfig
               freetype
               git
+              python3
+              nodejs
+              gh
+              jq
+              wget
+              # CI and local automation scripts rely on these CLIs so GitHub
+              # Actions and contributors can share the same flake-defined env.
               # Web build: `trunk build` per Trunk.toml. wasm-bindgen-cli must
-              # match the wasm-bindgen version Cargo.lock resolves, the same
-              # constraint .github/workflows/pages.yml:83 reads out of the lock.
+              # match the wasm-bindgen version Cargo.lock resolves.
               trunk
               wasm-bindgen-cli
               # Rasterises assets/logo.svg for packaging, as release.yml does.