diff --git a/ci.sh b/ci.sh
new file mode 100755
index 0000000..60c63d5
--- /dev/null
+++ b/ci.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -e -x
+
+# Use shell.nix if possible.
+
+MYPYPATH=$(pwd)/stubs mypy --strict webapp/__init__.py
+black webapp
+black stubs
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 0000000..081e93a
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,35 @@
+with import <nixpkgs> {};
+
+let
+  types-wtforms = ps: ps.buildPythonPackage rec {
+    pname = "types-wtforms";
+    version = "3.1.0.20240425";
+    format = "setuptools";
+  
+    src = fetchPypi {
+      inherit version;
+      pname = "types-WTForms";
+      hash = "sha256-Sf/B/lV26gc1t2P/935wYN057MZhJ2y9C0cJmSGzpvI=";
+    };
+  
+    doCheck = false;
+  };
+
+in pkgs.mkShell {
+  nativeBuildInputs = [
+    poetry
+    (python311.withPackages (ps: with ps; [
+      black
+      ldap
+      flask
+      flask-wtf
+      pillow
+      kerberos
+      (types-wtforms ps)
+    ]))
+    cyrus_sasl
+    openldap
+    libkrb5
+    mypy
+  ];
+}