diff --git a/.gitignore b/.gitignore
index 3a213aa..3e784db 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,3 +25,4 @@ vite.config.ts.timestamp-*
 
 # Nix
 /.direnv
+result*
diff --git a/flake.nix b/flake.nix
index 1ec8e7a..31a7207 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,6 +17,8 @@
         pkgs,
         ...
       }: {
+        packages.default = pkgs.callPackage ./nix/derivation.nix {};
+
         devShells.default = with pkgs;
           mkShellNoCC {
             buildInputs = [bun wrangler];
diff --git a/nix/derivation.nix b/nix/derivation.nix
new file mode 100644
index 0000000..6c1888a
--- /dev/null
+++ b/nix/derivation.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  stdenvNoCC,
+  bun,
+  nodejs,
+}: stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "tcl-guessr";
+    version = "0.0.1";
+
+    src = ../.;
+
+    nativeBuildInputs = [bun nodejs];
+
+    bunDeps = stdenvNoCC.mkDerivation {
+      pname = "${finalAttrs.pname}-bun-deps";
+      inherit (finalAttrs) version;
+
+      nativeBuildInputs = [bun];
+
+      src = lib.fileset.toSource {
+        root = finalAttrs.src;
+        fileset = lib.fileset.unions [
+          ../package.json
+          ../bun.lockb
+          ../patches
+        ];
+      };
+
+      dontConfigure = true;
+      dontBuild = true;
+
+      installPhase = ''
+        bun install \
+          --frozen-lockfile \
+          --ignore-scripts \
+          --backend copyfile \
+          --force
+
+        cp -r node_modules/ $out
+      '';
+
+      outputHashMode = "recursive";
+      outputHash = "sha256-cYbyVt2Hc96WRAIsNkgnG0vUB47m1ixbhYhHmXetaII=";
+    };
+
+    configurePhase = ''
+      cp -r $bunDeps node_modules
+      chmod -R +w node_modules
+      patchShebangs node_modules/{*,.*}
+    '';
+
+    buildPhase = ''
+      bun run build
+    '';
+
+    installPhase = ''
+      cp -r .svelte-kit/cloudflare $out
+    '';
+
+    passthru = {
+      inherit (finalAttrs) bunDeps;
+    };
+  })