diff --git a/.gitignore b/.gitignore
index 7357d551..7e4ee7a3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
+/result
 bcachefs
 .*
 *.o
diff --git a/default.nix b/default.nix
new file mode 100644
index 00000000..82d4a852
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,45 @@
+{ nixpkgs ? (import ./nix/nixpkgs.nix)
+}:
+
+with nixpkgs;
+
+stdenv.mkDerivation rec {
+  name = "bcachefs-tools-${version}";
+  version = "git";
+
+  src = lib.cleanSource ./.; # NOTE: ignore .git, otherwise things get weird!
+
+  nativeBuildInputs = [ git pkgconfig ];
+  buildInputs =
+    [ liburcu libuuid libaio zlib attr keyutils
+      libsodium libscrypt
+    ];
+
+  patchPhase = ''
+    # ensure the mkfs and fsck scripts, which are just wrappers around
+    # 'bcachefs', are patched to refer to the right location inside the
+    # nix store. (you wouldn't expect built tools to call random outside
+    # utilities, in general, but the exact tools they were built with.)
+    #
+    # TODO FIXME: it would be better to fix this in the 'install' target,
+    # however, so this works with any bog-standard installation
+
+    substituteInPlace fsck.bcachefs --replace bcachefs $out/bin/bcachefs
+    substituteInPlace mkfs.bcachefs --replace bcachefs $out/bin/bcachefs
+  '';
+
+  enableParallelBuilding = true;
+  makeFlags =
+    [ "PREFIX=$(out)"
+    ];
+
+  meta = with stdenv.lib; {
+    description = "Userspace tools for bcachefs";
+    homepage    = http://bcachefs.org;
+    license     = licenses.gpl2;
+    platforms   = platforms.linux;
+    maintainers =
+      [ "Kent Overstreet <kent.overstreet@gmail.com>"
+      ];
+  };
+}
diff --git a/nix/fetchnix.nix b/nix/fetchnix.nix
new file mode 100644
index 00000000..2f98788f
--- /dev/null
+++ b/nix/fetchnix.nix
@@ -0,0 +1,48 @@
+# `builtins.fetchTarball` only accepts a `sha256` argument in Nix version 1.12
+# or later, so here we provide a function that can provide a compatible interface
+# to Nix 1.11 or Nix 1.12
+#
+# TODO FIXME: remove this sometime after Nix 1.12 goes stable
+
+{ url                             # URL of the nixpkgs tarball to download
+, rev                             # The Git revision of nixpkgs to fetch
+, sha256                          # The SHA256 of the downloaded data
+, system ? builtins.currentSystem # This is overridable if necessary
+}:
+
+with {
+  ifThenElse = { bool, thenValue, elseValue }: (
+    if bool then thenValue else elseValue);
+};
+
+ifThenElse {
+  bool = (0 <= builtins.compareVersions builtins.nixVersion "1.12");
+
+  # In Nix 1.12, we can just give a `sha256` to `builtins.fetchTarball`.
+  thenValue = (builtins.fetchTarball { inherit url sha256; });
+
+  # This hack should at least work for Nix 1.11
+  elseValue = (
+    (rec {
+      tarball = import <nix/fetchurl.nix> { inherit url sha256; };
+      builtin-paths = import <nix/config.nix>;
+
+      script = builtins.toFile "nixpkgs-unpacker" ''
+        "$coreutils/mkdir" "$out"
+        cd "$out"
+        "$gzip" --decompress < "$tarball" | "$tar" -x --strip-components=1
+      '';
+
+      nixpkgs = builtins.derivation {
+        name = "nixpkgs-${builtins.substring 0 6 rev}";
+
+        builder = builtins.storePath builtin-paths.shell;
+        args = [ script ];
+
+        inherit tarball system;
+        tar       = builtins.storePath builtin-paths.tar;
+        gzip      = builtins.storePath builtin-paths.gzip;
+        coreutils = builtins.storePath builtin-paths.coreutils;
+      };
+    }).nixpkgs);
+}
diff --git a/nix/nixpkgs.json b/nix/nixpkgs.json
new file mode 100644
index 00000000..a5a11d05
--- /dev/null
+++ b/nix/nixpkgs.json
@@ -0,0 +1,5 @@
+{
+  "url":    "https://github.com/nixos/nixpkgs/archive/5ae883b8c3b04e0c4a9c92a5ab3c7c84b9942943.tar.gz",
+  "rev":    "5ae883b8c3b04e0c4a9c92a5ab3c7c84b9942943",
+  "sha256": "1s2nhax586v2fax7r5qd1s3d2gdg25isva7k7r9pf9x9ay630cmb"
+}
diff --git a/nix/nixpkgs.nix b/nix/nixpkgs.nix
new file mode 100644
index 00000000..00673665
--- /dev/null
+++ b/nix/nixpkgs.nix
@@ -0,0 +1,9 @@
+let
+  # Grab the versions we specified in the JSON file
+  nixpkgs   = builtins.fromJSON (builtins.readFile ./nixpkgs.json);
+
+  # Bootstrap a copy of nixpkgs, based on this.
+  src = import ./fetchnix.nix { inherit (nixpkgs) url rev sha256; };
+
+# We use the default nixpkgs configuration during bootstrap.
+in import src { config = {}; }
diff --git a/nix/update-nixpkgs.sh b/nix/update-nixpkgs.sh
new file mode 100755
index 00000000..770d2801
--- /dev/null
+++ b/nix/update-nixpkgs.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -e
+
+if [[ "x$1" == "x" ]]; then
+    echo "Must provide a revision argument"
+    echo "Usage:"
+    echo "  ./update-nixpkgs.sh <rev>"
+    echo "  ./update-nixpkgs.sh https://github.com/foo/nixpkgs <rev>"
+    exit 1
+fi
+
+if [[ "x$2" == "x" ]]; then
+    REV="$1"
+    URL="https://github.com/nixos/nixpkgs"
+else
+    REV="$2"
+    URL="$1"
+fi
+
+DOWNLOAD="$URL/archive/$REV.tar.gz"
+echo "Updating to nixpkgs revision $REV from $URL"
+SHA256=$(nix-prefetch-url "$DOWNLOAD")
+
+cat > nixpkgs.json <<EOF
+{
+  "url":    "$DOWNLOAD",
+  "rev":    "$REV",
+  "sha256": "$SHA256"
+}
+EOF
+
+echo "Updated nixpkgs.json"