diff --git a/.github/workflows/godot-ci.yml b/.github/workflows/godot-ci.yml
index 9381ed5..2327ae7 100644
--- a/.github/workflows/godot-ci.yml
+++ b/.github/workflows/godot-ci.yml
@@ -1,10 +1,6 @@
-# https://github.com/abarichello/godot-ci
-# https://github.com/abarichello/godot-ci/issues/123
-# https://github.com/abarichello/godot-ci/pull/113
-#
-# Thanks to MikulasZelinka for making this file!
+# Reproducible Godot 4.3 exports via Nix (see flake.nix / flake.lock).
+name: Build
 
-name: Godot Export
 on:
   push:
     branches:
@@ -12,48 +8,95 @@ on:
     paths-ignore:
       - "README.md"
       - ".gitattributes"
-      - ".gitignore"
+      - "LICENSE"
+  pull_request:
+  workflow_dispatch:
 
-env:
-  GODOT_VERSION: 4.2.1
+concurrency:
+  group: build-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
-  export-web:
-    name: Web Export
-    runs-on: ubuntu-20.04
-    container:
-      # TODO: how to interpolate the env var here?
-      # image: barichello/godot-ci:${GODOT_VERSION}
-      image: barichello/godot-ci:4.2.1
+  web:
+    name: Web (WASM)
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - name: 🛎️ Checkout
+      - name: Checkout
         uses: actions/checkout@v4
-      #   with:
-      #     lfs: true
-      - name: 🏹 Setup
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+
+      - name: Enable Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@v13
+
+      - name: Build web export
         run: |
-          mkdir -v -p ~/.local/share/godot/export_templates
-          mv /root/.local/share/godot/templates/${GODOT_VERSION}.stable ~/.local/share/godot/export_templates/${GODOT_VERSION}.stable
-          cd ~/.local/share/godot/export_templates/${GODOT_VERSION}.stable
-          ls -l
-      - name: 🔧 Web Build
+          nix build .#web -L -o artifacts-web
+          ls -lah artifacts-web
+
+      - name: Upload web artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: calculus-visualizations-web
+          path: artifacts-web/
+          if-no-files-found: error
+
+      - name: Prepare GitHub Pages bundle
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
         run: |
-          mkdir -v -p build/web
-          godot --headless --verbose --export-release "Web" ./build/web/index.html
-          ls -lah build/web
-      - name: 🤕 Netlify headers
-        # https://github.com/godotengine/godot/issues/69020
-        # https://github.com/godotengine/godot/blob/master/platform/web/serve.py
-        # https://docs.netlify.com/routing/headers/
+          mkdir -p _site
+          cp -a artifacts-web/. _site/
+
+      - name: Upload Pages artifact
+        if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: _site
+
+  linux:
+    name: Linux
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@v22
+
+      - name: Enable Nix cache
+        uses: DeterminateSystems/magic-nix-cache-action@v13
+
+      - name: Build Linux export
         run: |
-          cat <<EOF > build/web/_headers
-          /*
-            Cross-Origin-Opener-Policy: same-origin
-            Cross-Origin-Embedder-Policy: require-corp
-            Access-Control-Allow-Origin: *
-          EOF
-          cat build/web/_headers
-      - name: 🚀 Deploy to GitHub Pages
-        uses: JamesIves/github-pages-deploy-action@v4.4.3
+          nix build .#linux-portable -L -o artifacts-linux
+          ls -lah artifacts-linux
+
+      - name: Upload Linux artifact
+        uses: actions/upload-artifact@v4
         with:
-          folder: build/web
+          name: calculus-visualizations-linux-x86_64
+          path: artifacts-linux/
+          if-no-files-found: error
+
+  deploy:
+    name: Deploy GitHub Pages
+    needs: web
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    runs-on: ubuntu-latest
+    permissions:
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@v4
diff --git a/.gitignore b/.gitignore
index 36d72e3..871174f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,7 @@ data_*/
 mono_crash.*.json
 
 build/
+
+# Nix
+result
+result-*
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..147b968
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..0283671
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,187 @@
+{
+  description = "Reproducible Linux and WASM builds for Calculus Visualizations (Godot 4.3)";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = {
+    self,
+    nixpkgs,
+    flake-utils,
+  }:
+    flake-utils.lib.eachDefaultSystem (
+      system: let
+        pkgs = nixpkgs.legacyPackages.${system};
+        inherit (pkgs) lib;
+
+        # Project targets Godot 4.3 (see project.godot config/features).
+        godot = pkgs.godot_4_3;
+
+        pname = "calculus-visualizations";
+
+        src = lib.fileset.toSource {
+          root = ./.;
+          fileset = lib.fileset.unions [
+            ./project.godot
+            ./export_presets.cfg
+            ./icon.svg
+            ./icon.svg.import
+            ./MainMenu.gd
+            ./MainMenu.tscn
+            ./AboutPage
+            ./Assets
+            ./Axes
+            ./DiskMethod
+            ./GimbalCamera
+            ./ShapeCrossMethod
+          ];
+        };
+
+        # Shared setup: writable HOME + export templates linked where Godot expects them.
+        mkGodotExport = {
+          pname,
+          preset,
+          exportPath,
+          templates,
+          install,
+        }:
+          pkgs.stdenv.mkDerivation {
+            inherit pname src;
+            version = self.shortRev or self.dirtyShortRev or "dev";
+
+            strictDeps = true;
+
+            nativeBuildInputs = [
+              godot
+              pkgs.writableTmpDirAsHomeHook
+            ];
+
+            buildPhase = ''
+              runHook preBuild
+
+              mkdir -p "$HOME/.local/share/godot"
+              ln -s ${templates}/share/godot/export_templates \
+                "$HOME/.local/share/godot/export_templates"
+
+              mkdir -p "$(dirname ${lib.escapeShellArg exportPath})"
+              godot4 --headless --path "$PWD" --export-release ${lib.escapeShellArg preset} \
+                ${lib.escapeShellArg exportPath}
+
+              runHook postBuild
+            '';
+
+            installPhase = ''
+              runHook preInstall
+              ${install}
+              runHook postInstall
+            '';
+
+            meta = {
+              description = "Calculus Visualizations — solids of revolution and cross sections";
+              homepage = "https://github.com/yunusey/CalculusVisualizations";
+              license = lib.licenses.mit;
+              platforms = lib.platforms.linux;
+            };
+          };
+
+        linux = mkGodotExport {
+          pname = "${pname}-linux";
+          preset = "Linux";
+          exportPath = "build/linux/${pname}.x86_64";
+          # Source-built template is linked correctly for NixOS / nix run.
+          templates = godot.export-template;
+          install = ''
+            mkdir -p "$out/libexec" "$out/bin"
+            # Godot names the PCK after the basename without the arch suffix.
+            install -Dm755 build/linux/${pname}.x86_64 "$out/libexec/${pname}"
+            install -Dm644 build/linux/${pname}.pck "$out/libexec/${pname}.pck"
+            ln -s "$out/libexec/${pname}" "$out/bin/${pname}"
+          '';
+        };
+
+        # Official Godot Linux template — portable artifact for non-Nix systems.
+        linuxPortable =
+          (mkGodotExport {
+            pname = "${pname}-linux-portable";
+            preset = "Linux";
+            exportPath = "build/linux/${pname}.x86_64";
+            templates = godot.export-templates-bin;
+            install = ''
+              mkdir -p "$out"
+              install -Dm755 build/linux/${pname}.x86_64 "$out/${pname}.x86_64"
+              install -Dm644 build/linux/${pname}.pck "$out/${pname}.pck"
+            '';
+          }).overrideAttrs
+          (_: {
+            # Keep the upstream dynamic linker / RPATH for generic distros.
+            dontStrip = true;
+            dontPatchELF = true;
+          });
+
+        webHeaders = pkgs.writeText "${pname}-headers" ''
+          /*
+            Cross-Origin-Opener-Policy: same-origin
+            Cross-Origin-Embedder-Policy: require-corp
+            Access-Control-Allow-Origin: *
+        '';
+
+        web = mkGodotExport {
+          pname = "${pname}-web";
+          preset = "Web";
+          exportPath = "build/web/index.html";
+          # Official templates include the WebAssembly/HTML5 targets.
+          templates = godot.export-templates-bin;
+          install = ''
+            mkdir -p "$out"
+            cp -a build/web/. "$out/"
+            # COOP/COEP headers for Netlify / local serve.py.
+            cp ${webHeaders} "$out/_headers"
+          '';
+        };
+      in {
+        packages = {
+          inherit linux linuxPortable web;
+          default = linux;
+          # Alias for nix build .#linux-portable
+          linux-portable = linuxPortable;
+          all = pkgs.symlinkJoin {
+            name = "${pname}-all";
+            paths = [
+              linux
+              (pkgs.runCommand "${pname}-web-share" {} ''
+                mkdir -p "$out/share/${pname}"
+                ln -s ${web} "$out/share/${pname}/web"
+              '')
+            ];
+          };
+        };
+
+        apps = {
+          default = {
+            type = "app";
+            program = "${linux}/bin/${pname}";
+          };
+        };
+
+        devShells.default = pkgs.mkShell {
+          packages = [
+            godot
+            godot.export-templates-bin
+          ];
+          shellHook = ''
+            # Make export templates available to the editor / CLI exports.
+            mkdir -p "$HOME/.local/share/godot"
+            templates="$HOME/.local/share/godot/export_templates"
+            version_dir="${lib.versions.majorMinor godot.version}.stable"
+            if [ ! -e "$templates/$version_dir" ]; then
+              mkdir -p "$templates"
+              ln -sfn ${godot.export-templates-bin}/share/godot/export_templates/"$version_dir" \
+                "$templates/$version_dir"
+            fi
+          '';
+        };
+      }
+    );
+}