diff --git a/.gitignore b/.gitignore
index 94c8535..28c74c7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 /target/
+/web/target/
 /.clusterflux/
 **/.clusterflux/
 /vscode-extension/node_modules/
diff --git a/Cargo.lock b/Cargo.lock
index 26517cc..8f2f5a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1726,6 +1726,16 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "runtime-conformance"
+version = "0.1.0"
+dependencies = [
+ "clusterflux-sdk",
+ "futures-executor",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "rustc-hash"
 version = "2.1.3"
diff --git a/Cargo.toml b/Cargo.toml
index 22867aa..b4ff4d4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,6 @@
 [workspace]
 resolver = "2"
+exclude = ["web"]
 members = [
   "crates/clusterflux-cli",
   "crates/clusterflux-client",
diff --git a/README.md b/README.md
index 7e2ae67..e2c11ac 100644
--- a/README.md
+++ b/README.md
@@ -97,6 +97,9 @@ cargo install --path crates/clusterflux-coordinator --bin clusterflux-coordinato
 cargo install --path crates/clusterflux-dap --bin clusterflux-debug-dap
 ~~~
 
+On NixOS or another system with Nix, the equivalent package is available with
+`nix profile install .#clusterflux-tools`.
+
 Rootless Podman is required on Linux nodes that build or run a declared
 Containerfile environment. Install VS Code when you want the graphical debug
 workflow.
diff --git a/crates/clusterflux-node/src/assignment_runner/process_runner.rs b/crates/clusterflux-node/src/assignment_runner/process_runner.rs
index 48cfc97..e174722 100644
--- a/crates/clusterflux-node/src/assignment_runner/process_runner.rs
+++ b/crates/clusterflux-node/src/assignment_runner/process_runner.rs
@@ -70,26 +70,6 @@ pub(super) struct CoordinatorControlledProcessRunner {
     pub(super) configured_secrets: Vec<String>,
 }
 
-#[cfg(test)]
-mod tests {
-    use super::redact_safe_live_log_prefix;
-
-    #[test]
-    fn live_log_redaction_holds_boundaries_until_split_secrets_are_complete() {
-        let secrets = vec!["correct-horse".to_owned()];
-        let mut pending = b"prefix correct-".to_vec();
-        let (consumed, first) = redact_safe_live_log_prefix(&pending, &secrets, false).unwrap();
-        pending.drain(..consumed);
-        pending.extend_from_slice(b"horse suffix");
-        let (_, second) = redact_safe_live_log_prefix(&pending, &secrets, true).unwrap();
-
-        let combined = format!("{first}{second}");
-        assert_eq!(combined, "prefix [REDACTED] suffix");
-        assert!(!combined.contains("correct-"));
-        assert!(!combined.contains("horse"));
-    }
-}
-
 impl CoordinatorControlledProcessRunner {
     const MAX_CAPTURE_BYTES: usize = 256 * 1024 + 1;
 
@@ -601,3 +581,23 @@ impl ProcessRunner for CoordinatorControlledProcessRunner {
         })
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::redact_safe_live_log_prefix;
+
+    #[test]
+    fn live_log_redaction_holds_boundaries_until_split_secrets_are_complete() {
+        let secrets = vec!["correct-horse".to_owned()];
+        let mut pending = b"prefix correct-".to_vec();
+        let (consumed, first) = redact_safe_live_log_prefix(&pending, &secrets, false).unwrap();
+        pending.drain(..consumed);
+        pending.extend_from_slice(b"horse suffix");
+        let (_, second) = redact_safe_live_log_prefix(&pending, &secrets, true).unwrap();
+
+        let combined = format!("{first}{second}");
+        assert_eq!(combined, "prefix [REDACTED] suffix");
+        assert!(!combined.contains("correct-"));
+        assert!(!combined.contains("horse"));
+    }
+}
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 11e10a1..be09923 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -11,6 +11,9 @@ cargo install --path crates/clusterflux-node --bin clusterflux-node
 cargo install --path crates/clusterflux-dap --bin clusterflux-debug-dap
 ~~~
 
+On NixOS or another system with Nix, the equivalent package is available with
+`nix profile install .#clusterflux-tools`.
+
 Install rootless Podman on each Linux node that will execute container-backed
 environments.
 
diff --git a/flake.nix b/flake.nix
index f99377a..d9ccf26 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,6 +9,18 @@
       forAllSystems = nixpkgs.lib.genAttrs systems;
     in
     {
+      packages = forAllSystems (system:
+        let
+          pkgs = import nixpkgs { inherit system; };
+          publicPackages = import ./packages.nix { inherit pkgs self; };
+          privatePackages =
+            if builtins.pathExists ./web/packages.nix then
+              import ./web/packages.nix { inherit pkgs self; }
+            else
+              { };
+        in
+        publicPackages // privatePackages);
+
       devShells = forAllSystems (system:
         let
           pkgs = import nixpkgs { inherit system; };
diff --git a/packages.nix b/packages.nix
new file mode 100644
index 0000000..ed60115
--- /dev/null
+++ b/packages.nix
@@ -0,0 +1,65 @@
+{ pkgs, self }:
+let
+  clusterflux-tools = pkgs.rustPlatform.buildRustPackage {
+    pname = "clusterflux-tools";
+    version = "0.1.0";
+    src = self;
+    cargoLock.lockFile = ./Cargo.lock;
+    nativeBuildInputs = [
+      pkgs.git
+      pkgs.lld
+      pkgs.makeWrapper
+    ];
+    cargoBuildFlags = [
+      "--package"
+      "clusterflux-cli"
+      "--package"
+      "clusterflux-node"
+      "--package"
+      "clusterflux-coordinator"
+      "--package"
+      "clusterflux-dap"
+    ];
+    cargoTestFlags = [
+      "--package"
+      "clusterflux-cli"
+      "--package"
+      "clusterflux-node"
+      "--package"
+      "clusterflux-coordinator"
+      "--package"
+      "clusterflux-dap"
+    ];
+    NIX_BUILD_CORES = "2";
+    RUST_MIN_STACK = "1073741824";
+    postInstall = ''
+      test -x "$out/bin/clusterflux"
+      test -x "$out/bin/clusterflux-node"
+      test -x "$out/bin/clusterflux-coordinator"
+      test -x "$out/bin/clusterflux-debug-dap"
+    '';
+    postFixup =
+      let
+        runtimePath = pkgs.lib.makeBinPath [
+          pkgs.cargo
+          pkgs.git
+          pkgs.lld
+          pkgs.rustc
+        ];
+      in
+      ''
+        wrapProgram "$out/bin/clusterflux" --prefix PATH : ${runtimePath}
+        wrapProgram "$out/bin/clusterflux-node" --prefix PATH : ${runtimePath}
+        wrapProgram "$out/bin/clusterflux-debug-dap" --prefix PATH : ${runtimePath}
+      '';
+    meta = {
+      description = "Clusterflux CLI, node, coordinator, and debugger adapter";
+      mainProgram = "clusterflux";
+    };
+  };
+in
+{
+  inherit clusterflux-tools;
+  clusterflux = clusterflux-tools;
+  default = clusterflux-tools;
+}