diff --git a/.github/workflows/update-nix-versions.yml b/.github/workflows/update-nix-versions.yml
new file mode 100644
index 0000000000..cdf09dd2a8
--- /dev/null
+++ b/.github/workflows/update-nix-versions.yml
@@ -0,0 +1,92 @@
+name: Update Nix Versions
+
+on:
+  push:
+    tags:
+      - 'v[0-9]*'
+
+permissions:
+  contents: read
+
+jobs:
+  update-versions:
+    if: github.repository == 'block/buzz'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Extract version from tag
+        id: version
+        env:
+          TAG: ${{ github.ref_name }}
+        run: |
+          VERSION="${TAG#v}"
+          if ! echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$'; then
+            echo "::error::Invalid version '$VERSION' from tag '$TAG'"
+            exit 1
+          fi
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Update buzzVersion in versions.nix
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          sed -i 's/^  buzzVersion = ".*";$/  buzzVersion = "'"$VERSION"'";/' nix/versions.nix
+          echo "Updated buzzVersion to $VERSION"
+          grep 'buzzVersion' nix/versions.nix
+
+      - name: Create release tagger token
+        id: release-tagger
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.BUZZ_RELEASE_TAGGER_CLIENT_ID }}
+          private-key: ${{ secrets.BUZZ_RELEASE_TAGGER_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Check for existing PR
+        id: existing
+        env:
+          GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          PR_TITLE="chore(nix): update versions.nix to $VERSION"
+          EXISTING=$(gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --state open \
+            --head update-nix-versions/v"$VERSION" \
+            --json number,title \
+            --jq '.[].number' 2>/dev/null)
+          if [ -n "$EXISTING" ]; then
+            echo "PR #$EXISTING already exists for v$VERSION — skipping"
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Create pull request
+        if: steps.existing.outputs.enabled == 'true'
+        env:
+          GH_TOKEN: ${{ steps.release-tagger.outputs.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          BRANCH="update-nix-versions/v${VERSION}"
+          git config user.name "buzz-release-bot"
+          git config user.email "buzz-release-bot@block.xyz"
+          git checkout -b "$BRANCH"
+          git add nix/versions.nix
+          git commit -s -m "chore(nix): update versions.nix to ${VERSION}"
+          git push origin "$BRANCH"
+          gh pr create \
+            --repo "$GITHUB_REPOSITORY" \
+            --base main \
+            --head "$BRANCH" \
+            --title "chore(nix): update versions.nix to ${VERSION}" \
+            --body "Automated update of \`nix/versions.nix\` triggered by the \`v${VERSION}\` release tag.
+
+- Updates \`buzzVersion\` to \`${VERSION}\`
+- Dependency hashes are unchanged; regenerate with \`nix build\` if lockfiles changed."
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000000..db5ec039f8
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,78 @@
+{
+  "nodes": {
+    "block-buzz": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1785192424,
+        "narHash": "sha256-Bm9ajVN4xBCjiUHjnfqVXfXY702AeqSWbAGQAMV0xOs=",
+        "owner": "block",
+        "repo": "buzz",
+        "rev": "d8f9d87c17131b952ea5b6c3767978c4637545fc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "block",
+        "repo": "buzz",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1784796856,
+        "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "block-buzz": "block-buzz",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000000..ac26ba11e8
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,26 @@
+{
+  description = "Buzz desktop app";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+    block-buzz = {
+      url = "github:block/buzz";
+      flake = false;
+    };
+  };
+
+  outputs = { self, nixpkgs, flake-utils, block-buzz }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = import nixpkgs {
+          inherit system;
+          config.allowUnfree = true;
+        };
+      in
+      {
+        packages.default = pkgs.callPackage ./nix/buzz.nix {
+          src = block-buzz;
+        };
+      });
+}
diff --git a/nix/buzz.nix b/nix/buzz.nix
new file mode 100644
index 0000000000..a7cc8fa205
--- /dev/null
+++ b/nix/buzz.nix
@@ -0,0 +1,148 @@
+{
+  lib,
+  rustPlatform,
+  fetchPnpmDeps,
+  fetchurl,
+  cmake,
+  cargo-tauri,
+  nodejs,
+  pnpm,
+  pnpmConfigHook,
+  pkg-config,
+  wrapGAppsHook4,
+  makeWrapper,
+  gst_all_1,
+  glib-networking,
+  openssl,
+  webkitgtk_4_1,
+  alsa-lib,
+  libopus,
+  dbus,
+  glib,
+  gtk3,
+  libsoup_3,
+  librsvg,
+  darwin,
+  libiconv,
+  stdenv,
+  src,
+}:
+
+let
+  versions = import ./versions.nix;
+
+  sherpaOnnxSystemConfig = versions.sherpaOnnx.systems.${stdenv.hostPlatform.system} or (builtins.throw "Unsupported platform: ${stdenv.hostPlatform.system}. Supported platforms: ${builtins.toString (builtins.attrNames versions.sherpaOnnx.systems)}");
+
+  sherpaOnnxArchive = fetchurl {
+    name = "sherpa-onnx-v${versions.sherpaOnnx.version}-${sherpaOnnxSystemConfig.urlSuffix}.tar.bz2";
+    url = "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${versions.sherpaOnnx.version}/sherpa-onnx-v${versions.sherpaOnnx.version}-${sherpaOnnxSystemConfig.urlSuffix}.tar.bz2";
+    hash = sherpaOnnxSystemConfig.hash;
+  };
+
+  sidecarPackages = [ "buzz-acp" "buzz-agent" "buzz-dev-mcp" "git-credential-nostr" "buzz-cli" ];
+  sidecarBinNames = [ "buzz-acp" "buzz-agent" "buzz-dev-mcp" "git-credential-nostr" "buzz" ];
+
+  sidecars = rustPlatform.buildRustPackage {
+    pname = "buzz-sidecars";
+    version = versions.buzzVersion;
+
+    src = src;
+
+    cargoLock = {
+      lockFileContents = builtins.readFile (src + "/Cargo.lock");
+      outputHashes = versions.sidecarCargoOutputHashes;
+    };
+
+    cargoBuildFlags = lib.concatLists (map (p: [ "-p" p ]) sidecarPackages);
+    doCheck = false;
+
+    nativeBuildInputs = [
+      cmake
+      pkg-config
+    ];
+
+    buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+      openssl
+    ];
+
+    meta = with lib; {
+      description = "Buzz sidecar binaries";
+      license = licenses.unfree;
+      platforms = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
+    };
+  };
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "buzz-desktop";
+  version = versions.buzzVersion;
+
+  src = src;
+
+  cargoRoot = "desktop/src-tauri";
+  buildAndTestSubdir = "desktop/src-tauri";
+
+  cargoLock = {
+    lockFileContents = builtins.readFile (src + "/desktop/src-tauri/Cargo.lock");
+    outputHashes = versions.desktopCargoOutputHashes;
+  };
+
+  doCheck = false;
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    pnpm = pnpm;
+    fetcherVersion = 4;
+    hash = versions.pnpmHash;
+  };
+
+  preBuild = ''
+    mkdir -p $TMPDIR/sherpa-onnx-archive
+    ln -sf ${sherpaOnnxArchive} $TMPDIR/sherpa-onnx-archive/sherpa-onnx-v${versions.sherpaOnnx.version}-${sherpaOnnxSystemConfig.urlSuffix}.tar.bz2
+    export SHERPA_ONNX_ARCHIVE_DIR=$TMPDIR/sherpa-onnx-archive
+
+    mkdir -p desktop/src-tauri/binaries
+    for bin in ${builtins.concatStringsSep " " sidecarBinNames}; do
+      cp ${sidecars}/bin/$bin desktop/src-tauri/binaries/$bin-${stdenv.hostPlatform.config}
+    done
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    cargo-tauri.hook
+    nodejs
+    pnpmConfigHook
+    pnpm
+    pkg-config
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ wrapGAppsHook4 ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+    libopus
+    dbus
+    glib
+    gtk3
+    libsoup_3
+    librsvg
+    glib-networking
+    openssl
+    webkitgtk_4_1
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    libiconv
+    darwin.apple_sdk.frameworks.CoreFoundation
+    darwin.apple_sdk.frameworks.Security
+    darwin.apple_sdk.frameworks.SystemConfiguration
+    darwin.apple_sdk.frameworks.AppKit
+  ];
+
+  meta = with lib; {
+    description = "Buzz desktop app";
+    homepage = "https://buzz.ai";
+    license = licenses.unfree;
+      platforms = [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" ];
+    mainProgram = "buzz-desktop";
+  };
+})
diff --git a/nix/versions.nix b/nix/versions.nix
new file mode 100644
index 0000000000..97897115b1
--- /dev/null
+++ b/nix/versions.nix
@@ -0,0 +1,45 @@
+{
+  # App release version — bump on every release. Keep in sync with:
+  #   desktop/src-tauri/Cargo.toml, desktop/src-tauri/tauri.conf.json
+  buzzVersion = "0.5.0";
+
+  # sherpa-onnx static library archive for huddle audio.
+  # Per-platform archive URL and hash.
+  # Regenerate hashes after version bump: run
+  #   nix-prefetch-url <url>
+  # for each platform.
+  sherpaOnnx = {
+    version = "1.13.4";
+    systems = {
+      "x86_64-linux" = {
+        urlSuffix = "linux-x64-static-lib";
+        hash = "sha256-mLDjGZZCb254JE284ZVVSPLGTo8BxL51uFr3zaoujVw=";
+      };
+      "aarch64-linux" = {
+        urlSuffix = "linux-aarch64-static-lib";
+        hash = "sha256-03xwig2hfcj88li5qk01i8h5x00gana9g3j3n7alkjbwg0b3dcr3";
+      };
+      "aarch64-darwin" = {
+        urlSuffix = "osx-arm64-static-lib";
+        hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+      };
+    };
+  };
+
+  # Cargo.lock output hashes for sidecar builds (workspace root Cargo.lock).
+  # Regenerate after Cargo.lock changes: remove one, nix build will error with the correct hash.
+  sidecarCargoOutputHashes = {
+    "aws-creds-0.39.1" = "sha256-QAAm1phmeLFtDRgfDCoHijN1ce/rYzh18KziOUbL+hw=";
+    "mesh-llm-api-client-0.73.1" = "sha256-2ArkxK7Ze13mqkQB+JkuqVSCLeHpdxXHMZ0592VyEWw=";
+  };
+
+  # Cargo.lock output hashes for the desktop Tauri build (desktop/src-tauri/Cargo.lock).
+  # Same package may have a different hash vs. sidecars due to different dep trees.
+  desktopCargoOutputHashes = {
+    "mesh-llm-api-client-0.73.1" = "sha256-OItlWwacyTtdS6LQCQDPlLmB09l4bbTX27uI8AGDQpk=";
+  };
+
+  # Hash for pnpm dependencies (desktop frontend).
+  # Regenerate after package.json / pnpm-lock.yaml changes: remove and let nix build fetch.
+  pnpmHash = "sha256-Tboy+MG/VvdxUpJw7Xv0oubK58MIpvChvbU30uO4M4A=";
+}