diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
index d6c7c3ca7..5125e8a98 100644
--- a/.github/workflows/cmake.yml
+++ b/.github/workflows/cmake.yml
@@ -7,6 +7,18 @@ on:
     branches: [ trunk ]
 
 jobs:
+  build_nix:
+    runs-on: ubuntu-22.04
+    steps:
+    - uses: actions/checkout@v3
+    - name: Install Nix
+      uses: cachix/install-nix-action@v17
+    - name: Fix Nix installation
+      run: |
+        nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+        nix-channel --update
+    - name: Build
+      run: nix build .#
   build:
     strategy:
       matrix:
diff --git a/CMakeLists.txt b/CMakeLists.txt
index a7944ddd1..37c5667a2 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,6 +1,8 @@
 cmake_minimum_required(VERSION 3.5)
 project(python LANGUAGES C CXX VERSION 3.8.5)
 
+find_program(SYSTEM_PYTHON python3.8)
+
 set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 
@@ -394,7 +396,7 @@ else()
     OUTPUT
     ${FROZEN_MODULE_OUTPUT}
     COMMAND
-    /usr/bin/python3.8 util/freeze_modules.py ${FROZEN_MODULE_OUTPUT_DIR}
+    ${SYSTEM_PYTHON} util/freeze_modules.py ${FROZEN_MODULE_OUTPUT_DIR}
       ${FROZEN_MODULE_INPUT}
     WORKING_DIRECTORY
     ${CMAKE_SOURCE_DIR}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 000000000..c6c45e3a0
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1702366835,
+        "narHash": "sha256-7vf/mLwNbOvimdIjGUWHNMxmSrIz74R20d99YNw3Ppw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a46c5b471eea21bb4d1b75c9f3d3d8e66f2c3a1b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a46c5b471eea21bb4d1b75c9f3d3d8e66f2c3a1b",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 000000000..41e1203ee
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,34 @@
+{
+  description = "A flake for building Hello World";
+  inputs.nixpkgs.url = github:NixOS/nixpkgs/a46c5b471eea21bb4d1b75c9f3d3d8e66f2c3a1b;
+  outputs = { self, nixpkgs }: {
+    defaultPackage.x86_64-linux =
+      # Notice the reference to nixpkgs here.
+      with import nixpkgs { system = "x86_64-linux"; };
+      stdenv.mkDerivation {
+        pname = "python";
+        name = "skybison";
+        src = self;
+        dontUseCmakeConfigure=true;
+        buildInputs = [
+        cmake
+        clang
+        ninja
+        python38
+
+        bzip2
+        libffi
+        lzma
+        openssl
+        readline
+        sqlite
+        zlib
+        ];
+        buildPhase = ''
+        cmake -G Ninja -B build -DCMAKE_TOOLCHAIN_FILE=util/linux.cmake -DCMAKE_BUILD_TYPE=Debug -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++
+        ninja -C build python
+        '';
+        installPhase = "mv build $out";
+      };
+  };
+}
diff --git a/third-party/cpython/Modules/readline.c b/third-party/cpython/Modules/readline.c
index b2f58f9a8..d92261f34 100644
--- a/third-party/cpython/Modules/readline.c
+++ b/third-party/cpython/Modules/readline.c
@@ -1117,10 +1117,13 @@ setup_readline(readlinestate *mod_state)
     /* Set our completion function */
     rl_attempted_completion_function = flex_complete;
     /* Set Python word break characters */
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wincompatible-pointer-types-discards-qualifiers"
     completer_word_break_characters =
         rl_completer_word_break_characters =
         strdup(" \t\n`~!@#$%^&*()-=+[{]}\\|;:'\",<>/?");
         /* All nonalphanums except '.' */
+#pragma clang diagnostic pop
 
     mod_state->begidx = PyLong_FromLong(0L);
     mod_state->endidx = PyLong_FromLong(0L);