{
  inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";

  outputs =
    { self, nixpkgs }:
    let
      systems = [
        "x86_64-linux"
        "aarch64-darwin"
      ];
      forAllSystems = fn: nixpkgs.lib.genAttrs systems (system: fn nixpkgs.legacyPackages.${system});
    in
    {
      packages = forAllSystems (pkgs: {
        default = pkgs.callPackage ./package.nix { };
      });

      apps = forAllSystems (pkgs: {
        default = {
          type = "app";
          program = "${self.packages.${pkgs.stdenv.hostPlatform.system}.default}/bin/nix-cache-login";
          meta.description = "CLI tool for authenticating with a Nix binary cache via OIDC";
        };
      });

      checks = forAllSystems (pkgs: {
        tests = self.packages.${pkgs.stdenv.hostPlatform.system}.default.overrideAttrs (_: {
          pname = "nix-cache-login-tests";
          checkPhase = ''
            runHook preCheck
            go test ./...
            runHook postCheck
          '';
          doCheck = true;
        });
        devShell = self.devShells.${pkgs.stdenv.hostPlatform.system}.default;
      });

      devShells = forAllSystems (pkgs: {
        default = pkgs.mkShell {
          packages = with pkgs; [
            go
            cobra-cli
          ];
        };
      });

      nixosModules = {
        # Workstation: systemd user timer+service running `nix-cache-login refresh`
        default =
          {
            config,
            lib,
            pkgs,
            ...
          }:
          {
            imports = [ ./nixos-module.nix ];
            services.nix-cache-login.package =
              lib.mkDefault
                self.packages.${pkgs.stdenv.hostPlatform.system}.default;
          };

        # Server: system-level timer+service running `nix-cache-login service-account`
        server =
          {
            config,
            lib,
            pkgs,
            ...
          }:
          {
            imports = [ ./nixos-module-server.nix ];
            services.nix-cache-login-server.package =
              lib.mkDefault
                self.packages.${pkgs.stdenv.hostPlatform.system}.default;
          };
      };
    };
}