diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..c4a847d
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/result
diff --git a/default.nix b/default.nix
new file mode 100644
index 0000000..a3c7f04
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,53 @@
+{
+  stdenv,
+  lib,
+  shellcheck-minimal,
+  bats,
+  gitMinimal,
+}:
+
+let
+  fs = lib.fileset;
+in
+stdenv.mkDerivation {
+  pname = "git-check-assertions";
+  version = "0.0.1";
+
+  src = fs.toSource {
+    root = ./.;
+    fileset = fs.unions [
+      ./git-check-assertions
+      ./test.bats
+    ];
+  };
+
+  postPatch = ''
+    patchShebangs .
+  '';
+
+  nativeCheckInputs = [
+    shellcheck-minimal
+    bats
+    gitMinimal
+  ];
+
+  checkPhase = ''
+    shellcheck git-check-assertions test.bats
+    git init
+    git config user.email test
+    git config user.name test
+    git checkout -b main
+    git commit --allow-empty -m "initial"
+    ./test.bats
+  '';
+
+  doCheck = true;
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/git-check-assertions $out/bin/git-check-assertions
+    chmod +x $out/bin/git-check-assertions
+  '';
+
+  meta.mainProgram = "git-check-assertions";
+}
diff --git a/flake.nix b/flake.nix
index ec37673..55f8f46 100644
--- a/flake.nix
+++ b/flake.nix
@@ -14,11 +14,7 @@
         pkgs = nixpkgs.legacyPackages.${system};
       in
       {
-        packages.default = pkgs.writeShellApplication {
-          name = "git-check-assertions";
-          runtimeInputs = [ pkgs.git ];
-          text = builtins.readFile ./git-check-assertions;
-        };
+        packages.default = pkgs.callPackage ./default.nix { };
         devShells.default = pkgs.mkShell {
           packages = with pkgs; [ bats ];
         };