diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..6fa6725
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,64 @@
+name: "Rust checks"
+
+on:
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  check:
+    # Target self-hosted runner by label
+    runs-on: [ nixos ]
+
+    # SECURITY: Require manual approval for external PRs
+    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+
+    steps:
+      - name: checkout-code
+        uses: actions/checkout@v4
+
+      - name: cargo-check
+        env:
+          RUSTFLAGS: "-D warnings" # Make all warnings deny.
+        run: nix develop --command cargo check
+
+      - name: cargo-test
+        env:
+          RUSTFLAGS: "-D warnings" # Make all warnings deny.
+        run: nix develop --command cargo test
+
+      # TODO: make clippy work
+      # - name: cargo-clippy
+      #   env:
+      #     RUSTFLAGS: "-D warnings" # Make all warnings deny.
+      #   run: nix develop --command cargo clippy
+
+      - name: cargo-bench
+        run: nix develop --command cargo bench --no-run # Just to make sure it compiles
+
+      - name: cargo-fmt
+        run: nix develop --command cargo fmt --check
+
+      - name: cargo-doc
+        run: nix develop --command cargo doc
+
+      - name: nix-flake-check
+        run: nix flake check
+
+      - name: nix-deadnix
+        run: nix develop --command deadnix
+
+      - name: nix-statix
+        run: nix develop --command statix check
+
+      - name: nix-alejandra
+        run: nix develop --command alejandra --check .
+
+      # TODO: enable hongdown
+      # - name: markdown-formatting
+      #   run: nix develop --command hongdown --check .
+      
+
diff --git a/flake.lock b/flake.lock
index 80325c9..85e7d68 100644
--- a/flake.lock
+++ b/flake.lock
@@ -5,11 +5,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
       "original": {
@@ -20,10 +20,12 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 0,
-        "narHash": "sha256-hMyG9/WlUi0Ho9VkRrrez7SeNlDzLxalm9FwY7n/Noo=",
-        "path": "/nix/store/920a6ivyd50598z8djw9x3mr33gys0j5-source",
-        "type": "path"
+        "lastModified": 1770169770,
+        "narHash": "sha256-awR8qIwJxJJiOmcEGgP2KUqYmHG4v/z8XpL9z8FnT1A=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "aa290c9891fa4ebe88f8889e59633d20cc06a5f2",
+        "type": "github"
       },
       "original": {
         "id": "nixpkgs",
@@ -32,11 +34,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1728538411,
-        "narHash": "sha256-f0SBJz1eZ2yOuKUr5CA9BHULGXVSn6miBuUWdTyhUhU=",
+        "lastModified": 1744536153,
+        "narHash": "sha256-awS2zRgF4uTwrOKwwiJcByDzDOdo3Q1rPZbiHQg/N38=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "b69de56fac8c2b6f8fd27f2eca01dcda8e0a4221",
+        "rev": "18dd725c29603f582cf1900e0d25f9f1063dbf11",
         "type": "github"
       },
       "original": {
@@ -48,11 +50,11 @@
     },
     "nixpks": {
       "locked": {
-        "lastModified": 1711703276,
-        "narHash": "sha256-iMUFArF0WCatKK6RzfUJknjem0H9m4KgorO/p3Dopkk=",
+        "lastModified": 1770197578,
+        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "d8fe5e6c92d0d190646fb9f1056741a229980089",
+        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
         "type": "github"
       },
       "original": {
@@ -75,11 +77,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1730169013,
-        "narHash": "sha256-rvgF03ODu1uEYbdEsloN4fQrJ+k1NOv/7MJvCpHHnBk=",
+        "lastModified": 1770260791,
+        "narHash": "sha256-ADTBfENFjRVDQMcCycyX/pAy6NFI/Ct6Mrar3gsmXI0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "92eb1268cc19609f2fe24311b871f37bf3dc5afd",
+        "rev": "42ec85352e419e601775c57256a52f6d48a39906",
         "type": "github"
       },
       "original": {
diff --git a/flake.nix b/flake.nix
index fe8c888..7d2678e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -19,31 +19,37 @@
         pkgs = import nixpkgs {
           inherit system overlays;
         };
-        rust = (
-          pkgs.rust-bin.stable."1.82.0".default.override {
-            extensions = [
-              "rust-src"
-              "rust-analyzer"
-            ];
-            targets = ["x86_64-unknown-linux-gnu"];
-          }
-        );
+        rust = pkgs.rust-bin.stable.latest.default.override {
+          extensions = [
+            "rust-src"
+            "rust-analyzer"
+          ];
+          targets = ["x86_64-unknown-linux-gnu"];
+        };
+        buildInputs = with pkgs; [
+          openssl
+          protobuf
+          clang
+          pkg-config
+          fontconfig
+          cmake
+          # We use some `rustfmt` rules that are only available on the nightly channel.
+          (lib.hiPrio rust-bin.nightly."2026-02-01".rustfmt)
+          rust
+        ];
+        rust_tools = with pkgs; [
+          taplo
+          cargo-semver-checks
+        ];
+        nix_tools = with pkgs; [
+          alejandra # Nix code formatter.
+          deadnix # Nix dead code checker.
+          statix # Nix static code checker.
+        ];
       in
         with pkgs; {
           devShells.default = mkShell {
-            buildInputs = [
-              openssl
-              protobuf
-              clang
-              pkg-config
-              fontconfig
-              cmake
-              # We use some `rustfmt` rules that are only available on the nightly channel.
-              (lib.hiPrio rust-bin.nightly."2024-10-01".rustfmt)
-              rust
-              taplo
-              cargo-semver-checks
-            ];
+            buildInputs = buildInputs ++ nix_tools ++ rust_tools;
           };
         }
     );