diff --git a/.github/workflows/update-flake-hash.yml b/.github/workflows/update-flake-hash.yml
new file mode 100644
index 0000000..159e10c
--- /dev/null
+++ b/.github/workflows/update-flake-hash.yml
@@ -0,0 +1,74 @@
+name: "Update Flake Hash"
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+
+jobs:
+  update-flake:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+
+      - name: Get AppImage hash
+        id: hash
+        env:
+          RELEASE_VERSION: ${{ github.event.release.tag_name }}
+        run: |
+          # Remove 'v' prefix from tag if present
+          VERSION="${RELEASE_VERSION#v}"
+          APPIMAGE_URL="https://github.com/${{ github.repository }}/releases/download/v${VERSION}/Handy_${VERSION}_amd64.AppImage"
+
+          echo "Computing hash for: $APPIMAGE_URL"
+
+          # Retry logic in case AppImage isn't immediately available
+          for i in {1..30}; do
+            HASH=$(nix-prefetch-url --name "Handy_${VERSION}_amd64.AppImage" "$APPIMAGE_URL" 2>&1 | grep "^sha256-" || true)
+            if [ -n "$HASH" ]; then
+              echo "hash=$HASH" >> "$GITHUB_OUTPUT"
+              echo "Successfully computed hash: $HASH"
+              exit 0
+            fi
+            echo "Attempt $i: AppImage not yet available, waiting..."
+            sleep 5
+          done
+
+          echo "Failed to fetch AppImage after retries"
+          exit 1
+
+      - name: Update flake.nix
+        env:
+          HASH: ${{ steps.hash.outputs.hash }}
+        run: |
+          sed -i "s|hash = \"sha256-[^\"]*\"|hash = \"$HASH\"|" flake.nix
+
+          # Verify the hash was actually updated
+          if ! grep -q "hash = \"$HASH\"" flake.nix; then
+            echo "ERROR: Failed to update hash in flake.nix"
+            exit 1
+          fi
+          echo "Successfully updated flake.nix with hash: $HASH"
+
+      - name: Commit and push
+        env:
+          VERSION: ${{ github.event.release.tag_name }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          # Only commit if flake.nix actually changed
+          if git diff --quiet flake.nix; then
+            echo "Hash already up-to-date, no commit needed"
+          else
+            git add flake.nix
+            git commit -m "chore(nix): update AppImage hash for ${VERSION}"
+            git push
+            echo "Successfully pushed hash update"
+          fi
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..42c9926
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1767892417,
+        "narHash": "sha256-dhhvQY67aboBk8b0/u0XB6vwHdgbROZT3fJAjyNh5Ww=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..99f0090
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,78 @@
+{
+  description = "Handy - A free, open source, and extensible speech-to-text application that works completely offline";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+  }: let
+    supportedSystems = ["x86_64-linux"];
+    forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
+    # Read version from Cargo.toml
+    cargoToml = builtins.fromTOML (builtins.readFile ./src-tauri/Cargo.toml);
+    version = cargoToml.package.version;
+  in {
+    packages = forAllSystems (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      # AppImage-based package
+      handy-appimage = let
+        appimage = pkgs.appimageTools.wrapType2 {
+          pname = "handy-appimage-unwrapped";
+          inherit version;
+          src = pkgs.fetchurl {
+            url = "https://github.com/cjpais/Handy/releases/download/v${version}/Handy_${version}_amd64.AppImage";
+            hash = "sha256-tTswFYLCPGtMbHAb2bQMsklRiRCVXLrtu4pQC8IHdqQ=";
+          };
+          extraPkgs = p:
+            with p; [
+              alsa-lib
+            ];
+        };
+      in
+        pkgs.writeShellScriptBin "handy" ''
+          export WEBKIT_DISABLE_DMABUF_RENDERER=1
+          exec ${appimage}/bin/handy-appimage-unwrapped "$@"
+        '';
+
+      default = self.packages.${system}.handy-appimage;
+    });
+
+    # Development shell for building from source
+    devShells = forAllSystems (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
+      default = pkgs.mkShell {
+        buildInputs = with pkgs; [
+          # Rust
+          rustc
+          cargo
+          rust-analyzer
+          clippy
+          # Frontend
+          nodejs
+          bun
+          # Native deps
+          pkg-config
+          openssl
+          alsa-lib
+          libsoup_3
+          webkitgtk_4_1
+          gtk3
+          glib
+          # Tauri CLI
+          cargo-tauri
+        ];
+
+        shellHook = ''
+          echo "Handy development environment"
+          bun install
+          echo "Run 'bun run tauri dev' to start"
+        '';
+      };
+    });
+  };
+}