diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
new file mode 100644
index 00000000000..5b74e54d195
--- /dev/null
+++ b/.github/workflows/nix.yml
@@ -0,0 +1,43 @@
+name: Test Nix Flake
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  nix-flake-check:
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+      - uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - name: nix flake check for all platforms
+        run: |
+          nix flake check --all-systems
+  nix-build-linux:
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+      - uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - name: nix build . for x86_64-linux
+        run: nix build .
+  nix-build-macos:
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          submodules: recursive
+      - uses: cachix/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - name: nix build for x86_64-darwin
+        run: nix build .
diff --git a/codex-rs/default.nix b/codex-rs/default.nix
index d2d4dfb6ba5..c512a3beed6 100644
--- a/codex-rs/default.nix
+++ b/codex-rs/default.nix
@@ -1,40 +1,53 @@
-{ pkgs, monorep-deps ? [], ... }:
-let
+{
+  pkgs,
+  monorepo-deps ? [],
+  ...
+}: let
+  lib = pkgs.lib;
+
   env = {
     PKG_CONFIG_PATH = "${pkgs.openssl.dev}/lib/pkgconfig:$PKG_CONFIG_PATH";
   };
-in
-rec {
+in rec {
   package = pkgs.rustPlatform.buildRustPackage {
     inherit env;
     pname = "codex-rs";
     version = "0.1.0";
-    cargoLock.lockFile = ./Cargo.lock;
-    doCheck = false;
     src = ./.;
+
+    cargoLock = {
+      lockFile = ./Cargo.lock;
+      # ratatui is patched via git, so we must whitelist its fixed-output hash
+      outputHashes = {
+        "ratatui-0.29.0" = "sha256-HBvT5c8GsiCxMffNjJGLmHnvG77A6cqEL+1ARurBXho=";
+      };
+    };
+
+    doCheck = false;
+
     nativeBuildInputs = with pkgs; [
       pkg-config
       openssl
     ];
-    meta = with pkgs.lib; {
-      description = "OpenAI Codex command‑line interface rust implementation";
+
+    meta = with lib; {
+      description = "OpenAI Codex command line interface rust implementation";
       license = licenses.asl20;
       homepage = "https://github.com/openai/codex";
     };
   };
+
   devShell = pkgs.mkShell {
     inherit env;
     name = "codex-rs-dev";
-    packages = monorep-deps ++ [
-      pkgs.cargo
-      package
-    ];
+    packages = monorepo-deps ++ [package];
     shellHook = ''
       echo "Entering development shell for codex-rs"
       alias codex="cd ${package.src}/tui; cargo run; cd -"
       ${pkgs.rustPlatform.cargoSetupHook}
     '';
   };
+
   app = {
     type = "app";
     program = "${package}/bin/codex";
diff --git a/flake.lock b/flake.lock
index 6e4f3acce7e..f7946d555a1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -20,11 +20,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1744463964,
-        "narHash": "sha256-LWqduOgLHCFxiTNYi3Uj5Lgz0SR+Xhw3kr/3Xd0GPTM=",
+        "lastModified": 1758427187,
+        "narHash": "sha256-pHpxZ/IyCwoTQPtFIAG2QaxuSm8jWzrzBGjwQZIttJc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2631b0b7abcea6e640ce31cd78ea58910d31e650",
+        "rev": "554be6495561ff07b6c724047bdd7e0716aa7b46",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746844454,
-        "narHash": "sha256-GcUWDQUDRYrD34ol90KGUpjbVcOfUNbv0s955jPecko=",
+        "lastModified": 1758681214,
+        "narHash": "sha256-8cW731vev6kfr58cILO2ZsjHwaPhm88dQ8Q6nTSjP9I=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "be092436d4c0c303b654e4007453b69c0e33009e",
+        "rev": "b12ed88d8d33d4f3cbc842bf29fad93bb1437299",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index 7247333c5a3..a26078ddcf2 100644
--- a/flake.nix
+++ b/flake.nix
@@ -10,48 +10,70 @@
     };
   };
 
-  outputs = { nixpkgs, flake-utils, rust-overlay, ... }: 
-    flake-utils.lib.eachDefaultSystem (system:
-      let
-        pkgs = import nixpkgs {
-          inherit system;
-        };
-        pkgsWithRust = import nixpkgs {
-          inherit system;
-          overlays = [ rust-overlay.overlays.default ];
-        };
-        monorepo-deps = with pkgs; [
-          # for precommit hook
-          pnpm
-          husky
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+    rust-overlay,
+    ...
+  }:
+    flake-utils.lib.eachDefaultSystem (system: let
+      # Base pkgs with the Rust overlay
+      pkgsBase = import nixpkgs {
+        inherit system;
+        overlays = [rust-overlay.overlays.default];
+      };
+
+      # Use toolchain pinned in ./codex-rs/rust-toolchain.toml, fallback to stable 1.89.0
+      rustToolchain =
+        if builtins.pathExists ./codex-rs/rust-toolchain.toml
+        then pkgsBase.rust-bin.fromRustupToolchainFile ./codex-rs/rust-toolchain.toml
+        else pkgsBase.rust-bin.stable."1.89.0".default;
+
+      # Reimport pkgs and override rustPlatform to use that toolchain for builds
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [
+          rust-overlay.overlays.default
+          (final: prev: {
+            rustPlatform = prev.makeRustPlatform {
+              cargo = rustToolchain;
+              rustc = rustToolchain;
+            };
+          })
         ];
-        codex-cli = import ./codex-cli {
-          inherit pkgs monorepo-deps;
-        };
-        codex-rs = import ./codex-rs {
-          pkgs = pkgsWithRust;
-          inherit monorepo-deps;
-        };
-      in
-      rec {
-        packages = {
-          codex-cli = codex-cli.package;
-          codex-rs = codex-rs.package;
-        };
+      };
 
-        devShells = {
-          codex-cli = codex-cli.devShell;
-          codex-rs = codex-rs.devShell;
-        };
+      monorepo-deps = with pkgs; [
+        pnpm
+        husky
+      ];
+
+      codex-rs = import ./codex-rs {
+        inherit pkgs monorepo-deps;
+      };
+    in rec {
+      packages = {
+        codex-rs = codex-rs.package;
+        default = codex-rs.package;
+      };
+
+      apps = {
+        codex-rs = codex-rs.app;
+        default = codex-rs.app;
+      };
 
-        apps = {
-          codex-cli = codex-cli.app;
-          codex-rs = codex-rs.app;
+      devShells = {
+        # Dev shell includes the pinned toolchain on PATH
+        codex-rs = pkgs.mkShell {
+          packages = monorepo-deps ++ [rustToolchain codex-rs.package];
         };
+        default = devShells.codex-rs;
+      };
 
-        defaultPackage = packages.codex-cli;
-        defaultApp = apps.codex-cli;
-        defaultDevShell = devShells.codex-cli;
-      }
-    );
+      # Optional CI hook to ensure the package builds
+      checks = {
+        codex-rs-build = packages.codex-rs;
+      };
+    });
 }