diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..3550a30
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..2cec600
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,45 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+  actions: read
+  pull-requests: write
+
+jobs:
+  e2e:
+    name: End-to-end
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      # Run the action on its own repo (dogfooding). This installs Nix,
+      # sets up caching, and picks up the repo's .envrc via direnv.
+      - uses: ./
+
+      - name: Assert Nix is installed
+        shell: bash
+        run: nix --version
+
+      - name: Assert direnv is on PATH
+        shell: bash
+        run: |
+          command -v direnv
+          direnv --version
+
+      - name: Assert .envrc env was exported
+        shell: bash
+        run: |
+          echo "NIX_MAGIC_SETUP_E2E=${NIX_MAGIC_SETUP_E2E:-<unset>}"
+          if [ "${NIX_MAGIC_SETUP_E2E:-}" != "ok" ]; then
+            echo "::error::marker env var from .envrc was not exported into the job environment"
+            exit 1
+          fi
+
+      - name: Assert flake evaluates
+        shell: bash
+        run: nix flake check
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..ff083e0
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1782948114,
+        "narHash": "sha256-AXmz9ho4Lud5CsbrZsuSVwpQZ4o5FgZ1chxBn5cJ8+0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "9e92285f211dad236540fd617d7e30e0b99bc0e1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "ref": "nixos-unstable",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..032a8e4
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,26 @@
+{
+  description = "nix-magic-setup CI fixture flake (used to exercise the action end-to-end)";
+
+  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+
+  outputs =
+    { self, nixpkgs }:
+    let
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+      forEachSystem = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
+    in
+    {
+      devShells = forEachSystem (pkgs: {
+        default = pkgs.mkShell {
+          # Marker variable the E2E workflow asserts on, to prove the
+          # .envrc -> direnv -> $GITHUB_ENV export chain worked on a real runner.
+          NIX_MAGIC_SETUP_E2E = "ok";
+        };
+      });
+    };
+}