diff --git a/.github/workflows/build-nix.yml b/.github/workflows/build-nix.yml
new file mode 100644
index 000000000..ac40c1edd
--- /dev/null
+++ b/.github/workflows/build-nix.yml
@@ -0,0 +1,37 @@
+name: build-nix
+on:
+  pull_request:
+    branches:
+      - main
+  push:
+    branches:
+      - main
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    container:
+      image: nixos/nix:latest
+    steps:
+      - name: test
+        run: |
+          set -x
+
+          git clone https://github.com/${{ github.repository }}.git
+          cd $(basename ${{ github.repository }})
+
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-${{ github.event.pull_request.number }}
+            git checkout pr-${{ github.event.pull_request.number }}
+          else
+            git checkout ${{ github.ref_name }}
+          fi
+
+          nix-shell --run "
+            ODOC_WARN_ERROR=true
+            dune build @doc &&
+            dune build @install
+          "
+
+          nix-shell -p git --run "
+            git diff --exit-code goblint-cil.opam
+          "
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 000000000..0a6f20bcd
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,20 @@
+{ pkgs ? import (builtins.fetchTarball {
+    url = "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
+  }) {}
+}:
+
+pkgs.mkShell {
+  dontDetectOcamlConflicts = true;
+  nativeBuildInputs = with pkgs.ocamlPackages; [
+    cppo
+    dune-configurator
+    dune_3
+    findlib
+    ocaml
+    odoc
+    ppx_deriving_yojson
+  ];
+  buildInputs = with pkgs.ocamlPackages; [
+    zarith
+  ];
+}