diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..b7504c0
--- /dev/null
+++ b/.envrc
@@ -0,0 +1,2 @@
+use flake
+lefthook install >/dev/null
diff --git a/.gitignore b/.gitignore
index 82600a0..b0aabd9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -5,3 +5,5 @@ composer.lock
 .php_cs.cache
 .phpunit.result.cache
 .php-cs-fixer.cache
+.direnv
+.DS_Store
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..a3a9b5f
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1789546076,
+        "narHash": "sha256-zVxLZiSnmaaPLwnhj7pwmqe3axBg/C6nG5JZsJMh2g4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..7bdad15
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,25 @@
+{
+  description = "MailerLite PHP SDK environment";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+
+  outputs = { self, nixpkgs }:
+    let
+      systems = [ "aarch64-darwin" "x86_64-darwin" "aarch64-linux" "x86_64-linux" ];
+      forEachSystem = f:
+        nixpkgs.lib.genAttrs systems (system: f system nixpkgs.legacyPackages.${system});
+    in
+    {
+      devShells = forEachSystem (system: pkgs: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [
+            lefthook
+            gitleaks
+            git-secrets
+          ];
+        };
+      });
+    };
+}
diff --git a/lefthook.yml b/lefthook.yml
new file mode 100644
index 0000000..ef395d5
--- /dev/null
+++ b/lefthook.yml
@@ -0,0 +1,14 @@
+---
+pre-commit:
+  commands:
+    gitleaks:
+      run: gitleaks git --pre-commit --redact --staged --verbose --no-banner
+      fail_text: Staged changes contain a secret. Remove it; never commit and revert.
+    secrets:
+      run: |
+        git secrets --list | grep -q 'mssp' || {
+          git secrets --register-aws
+          git secrets --add 'mlsn\.[A-Za-z0-9._-]+'
+          git secrets --add 'mssp\.[A-Za-z0-9._-]+'
+        }
+        git secrets --scan {staged_files}
\ No newline at end of file