diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
new file mode 100644
index 0000000..9c94b0d
--- /dev/null
+++ b/.github/workflows/nix.yml
@@ -0,0 +1,21 @@
+name: nix build
+
+on:
+  - push
+  - pull_request
+jobs:
+  check_nix:
+    name: Check nix build
+    runs-on: ubuntu-latest
+    steps:
+      - name: git checkout
+        uses: actions/checkout@v3
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: system-features = nixos-test benchmark big-parallel kvm
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - name: Check Nix flake inputs
+        uses: DeterminateSystems/flake-checker-action@v4
+      - name: Build lib
+        run: nix build -L
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..6e40189
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,270 @@
+{
+  "nodes": {
+    "chronos": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1710161479,
+        "narHash": "sha256-VyCGCIA6t2VR0v0AUYDKykjQO62Rj1jDzqNql0HPmwA=",
+        "owner": "byteverse",
+        "repo": "chronos",
+        "rev": "5a1dee666cc5a805461db4ce36bd6c3112b80f14",
+        "type": "github"
+      },
+      "original": {
+        "owner": "byteverse",
+        "repo": "chronos",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "libsodium-bindings",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "gitignore_2": {
+      "inputs": {
+        "nixpkgs": [
+          "libsodium-bindings",
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "libsodium-bindings": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils_2",
+        "gitignore": "gitignore",
+        "nixpkgs": "nixpkgs",
+        "pre-commit-hooks": "pre-commit-hooks"
+      },
+      "locked": {
+        "lastModified": 1713048530,
+        "narHash": "sha256-twPl1o4kZg3+/cl+WQA+wUInccMLsSgMEw4Zj2OS+zQ=",
+        "ref": "refs/heads/nix/reintroduce",
+        "rev": "a7ca63a51dc1821a85e183b0858cb0ed7810cf44",
+        "revCount": 171,
+        "type": "git",
+        "url": "file:///home/black/ancien/haskell/libsodium-bindings"
+      },
+      "original": {
+        "owner": "haskell-cryptography",
+        "repo": "libsodium-bindings",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1713010524,
+        "narHash": "sha256-ZhZIQcTtN1gn3XQTCj2Upap0wEtjTVSVC9whphx3xYg=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "70850f72a07194b8071b6f839846f4d636d0b43f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-23.11-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1710695816,
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1713010524,
+        "narHash": "sha256-ZhZIQcTtN1gn3XQTCj2Upap0wEtjTVSVC9whphx3xYg=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "70850f72a07194b8071b6f839846f4d636d0b43f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-23.11-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "flake-utils": [
+          "libsodium-bindings",
+          "flake-utils"
+        ],
+        "gitignore": "gitignore_2",
+        "nixpkgs": [
+          "libsodium-bindings",
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1712897695,
+        "narHash": "sha256-nMirxrGteNAl9sWiOhoN5tIHyjBbVi5e2tgZUgZlK3Y=",
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "rev": "40e6053ecb65fcbf12863338a6dcefb3f55f1bf8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "pre-commit-hooks.nix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "chronos": "chronos",
+        "flake-utils": "flake-utils",
+        "libsodium-bindings": "libsodium-bindings",
+        "nixpkgs": "nixpkgs_2"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..0649dda
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,52 @@
+{
+  description = "one-time-password";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11-small";
+    flake-utils.url = "github:numtide/flake-utils";
+    libsodium-bindings.url = "github:haskell-cryptography/libsodium-bindings";
+    chronos = {
+      url = "github:byteverse/chronos";
+      flake = false;
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, ... }@inputs:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs{inherit system;};
+      in
+      rec
+      {
+        packages.one-time-password =
+          pkgs.haskellPackages.callCabal2nix "one-time-password" ./.
+            {
+              base32 = pkgs.haskellPackages.base32_0_4;
+              chronos = pkgs.haskellPackages.callCabal2nix "chronos" inputs.chronos {};
+              sel = inputs.libsodium-bindings.packages.${system}.sel;
+            };
+
+        defaultPackage = packages.one-time-password;
+
+        devShell =
+          let
+            scripts = pkgs.symlinkJoin {
+              name = "scripts";
+              paths = pkgs.lib.mapAttrsToList pkgs.writeShellScriptBin {
+              };
+            };
+          in
+          pkgs.mkShell {
+            buildInputs = with pkgs.haskellPackages; [
+              pkgs.libsodium
+              haskell-language-server
+              ghcid
+              cabal-install
+              scripts
+            ];
+            inputsFrom = [
+              self.defaultPackage.${system}.env
+            ];
+          };
+      });
+}
diff --git a/one-time-password.cabal b/one-time-password.cabal
index 9474984..4788c6e 100644
--- a/one-time-password.cabal
+++ b/one-time-password.cabal
@@ -55,7 +55,7 @@ library
     , cryptohash-sha1  ^>=0.11
     , network-uri      ^>=2.6
     , sel              ^>=0.0
-    , text             ^>=2.1
+    , text             >=2.0    && <2.2
     , text-display     ^>=0.0
 
   ghc-options:     -Wall