diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bafe274..6eb20fd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,3 +45,25 @@ jobs:
         reporter: 'github-check'
     - name: Run tests
       run: cargo test --locked
+
+  nix-flake-test:
+    name: Flake checks ❄️
+    strategy:
+      matrix:
+        platform: [ubuntu-latest, macos-latest]
+    runs-on: ${{ matrix.platform }}
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+      - uses: cachix/install-nix-action@v31
+        with:
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: cachix/cachix-action@v15
+        with:
+          name: iamb-prs
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+      - name: Flake check
+        run: |
+          nix flake show
+          nix flake check --print-build-logs
+
diff --git a/flake.lock b/flake.lock
index 571d146..49d8ee5 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,41 @@
 {
   "nodes": {
+    "crane": {
+      "locked": {
+        "lastModified": 1759893430,
+        "narHash": "sha256-yAy4otLYm9iZ+NtQwTMEbqHwswSFUbhn7x826RR6djw=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "1979a2524cb8c801520bd94c38bb3d5692419d93",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1760510549,
+        "narHash": "sha256-NP+kmLMm7zSyv4Fufv+eSJXyqjLMUhUfPT6lXRlg/bU=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "ef7178cf086f267113b5c48fdeb6e510729c8214",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -20,11 +56,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1756542300,
-        "narHash": "sha256-tlOn88coG5fzdyqz6R93SQL5Gpq+m/DsWpekNFhqPQk=",
+        "lastModified": 1760284886,
+        "narHash": "sha256-TK9Kr0BYBQ/1P5kAsnNQhmWWKgmZXwUQr4ZMjCzWf2c=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d7600c775f877cd87b4f5a831c28aa94137377aa",
+        "rev": "cf3f5c4def3c7b5f1fc012b3d839575dbe552d43",
         "type": "github"
       },
       "original": {
@@ -34,44 +70,28 @@
         "type": "github"
       }
     },
-    "nixpkgs_2": {
-      "locked": {
-        "lastModified": 1744536153,
-        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
+        "crane": "crane",
+        "fenix": "fenix",
         "flake-utils": "flake-utils",
-        "nixpkgs": "nixpkgs",
-        "rust-overlay": "rust-overlay"
+        "nixpkgs": "nixpkgs"
       }
     },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_2"
-      },
+    "rust-analyzer-src": {
+      "flake": false,
       "locked": {
-        "lastModified": 1756694554,
-        "narHash": "sha256-z/Iy4qvcMqzhA2IAAg71Sw4BrMwbBHvCS90ZoPLsnIk=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "b29e5365120f344fe7161f14fc9e272fcc41ee56",
+        "lastModified": 1760457219,
+        "narHash": "sha256-WJOUGx42hrhmvvYcGkwea+BcJuQJLcns849OnewQqX4=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "8747cf81540bd1bbbab9ee2702f12c33aa887b46",
         "type": "github"
       },
       "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
         "type": "github"
       }
     },
diff --git a/flake.nix b/flake.nix
index d64d7f6..f91122f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,49 +5,99 @@
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     flake-utils.url = "github:numtide/flake-utils";
-    rust-overlay.url = "github:oxalica/rust-overlay";
+    crane.url = "github:ipetkov/crane";
+    fenix = {
+      url = "github:nix-community/fenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
     {
       self,
       nixpkgs,
+      crane,
       flake-utils,
-      rust-overlay,
+      fenix,
       ...
     }:
     flake-utils.lib.eachDefaultSystem (
       system:
       let
-        # We only need the nightly overlay in the devShell because .rs files are formatted with nightly.
-        overlays = [ (import rust-overlay) ];
-        pkgs = import nixpkgs { inherit system overlays; };
-        rustNightly = pkgs.rust-bin.nightly."2025-08-31".default;
-      in
-      with pkgs;
-      {
-        packages.default = rustPlatform.buildRustPackage {
-          pname = "iamb";
-          version = self.shortRev or self.dirtyShortRev;
-          src = ./.;
-          cargoLock = {
-            lockFile = ./Cargo.lock;
-          };
-          nativeBuildInputs = [ pkg-config ];
-          buildInputs = [ openssl ];
+        pkgs = nixpkgs.legacyPackages.${system};
+        inherit (pkgs) lib;
+
+        rustToolchain = fenix.packages.${system}.fromToolchainFile {
+          file = ./rust-toolchain.toml;
+          # When the file changes, this hash must be updated.
+          sha256 = "sha256-Hn2uaQzRLidAWpfmRwSRdImifGUCAb9HeAqTYFXWeQk=";
         };
 
-        devShell = mkShell {
-          buildInputs = [
-            (rustNightly.override {
-              extensions = [
-                "rust-src"
-                "rust-analyzer-preview"
-                "rustfmt"
-                "clippy"
-              ];
-            })
-            pkg-config
+        # Nightly toolchain for rustfmt (pinned to current flake lock)
+        # Note that the github CI uses "current nightly" for formatting, it 's not pinned.
+        rustNightly = fenix.packages.${system}.latest.toolchain;
+        rustNightlyFmt = fenix.packages.${system}.latest.rustfmt;
+
+        craneLib = (crane.mkLib pkgs).overrideToolchain rustToolchain;
+        craneLibNightly = (crane.mkLib pkgs).overrideToolchain rustNightly;
+
+        src = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.unions [
+            (craneLib.fileset.commonCargoSources ./.)
+            ./src/windows/welcome.md
+          ];
+        };
+
+        commonArgs = {
+          inherit src;
+          strictDeps = true;
+          pname = "iamb";
+          version = self.shortRev or self.dirtyShortRev;
+        };
+
+        # Build *just* the cargo dependencies, so we can reuse
+        # all of that work (e.g. via cachix) when running in CI
+        cargoArtifacts = craneLib.buildDepsOnly commonArgs;
+
+        # Build the actual crate
+        iamb = craneLib.buildPackage (commonArgs // {
+          inherit cargoArtifacts;
+        });
+      in
+      {
+        checks = {
+          # Build the crate as part of `nix flake check`
+          inherit iamb;
+
+          iamb-clippy = craneLib.cargoClippy (commonArgs // {
+            inherit cargoArtifacts;
+            cargoClippyExtraArgs = "--all-targets -- --deny warnings";
+          });
+
+          iamb-fmt = craneLibNightly.cargoFmt {
+            inherit src;
+          };
+
+          iamb-nextest = craneLib.cargoNextest (commonArgs // {
+            inherit cargoArtifacts;
+            partitions = 1;
+            partitionType = "count";
+          });
+        };
+
+        packages.default = iamb;
+
+        apps.default = flake-utils.lib.mkApp {
+          drv = iamb;
+        };
+
+        devShells.default = craneLib.devShell {
+          # Inherit inputs from checks
+          checks = self.checks.${system};
+
+          packages = with pkgs; [
+            rustNightlyFmt
             cargo-tarpaulin
             cargo-watch
             sqlite
diff --git a/src/notifications.rs b/src/notifications.rs
index b4938fe..f90b1aa 100644
--- a/src/notifications.rs
+++ b/src/notifications.rs
@@ -139,6 +139,7 @@ async fn send_notification_bell(store: &AsyncProgramStore) {
 }
 
 #[cfg(feature = "desktop")]
+#[cfg_attr(target_os = "macos", allow(unused_variables))]
 async fn send_notification_desktop(
     summary: &str,
     body: Option<&str>,