diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ad7d7f4..3546c48 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -24,4 +24,7 @@ jobs:
             substituters = https://staging.attic.rs/attic-ci https://cache.nixos.org
             trusted-public-keys = attic-ci:U5Sey4mUxwBXM3iFapmP0/ogODXywKLRNgRPQpEXxbo= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
 
-      - run: nix develop --command -- cargo test
+      - name: Build and run tests
+        run: |
+          tests=$(nix build .#attic-tests --no-link --print-out-paths -L)
+          find "$tests/bin" -exec {} \;
diff --git a/crane.nix b/crane.nix
new file mode 100644
index 0000000..3ed39c0
--- /dev/null
+++ b/crane.nix
@@ -0,0 +1,138 @@
+# For distribution from this repository as well as CI, we use Crane to build
+# Attic.
+#
+# For a nixpkgs-acceptable form of the package expression, see `package.nixpkgs.nix`
+# which will be submitted when the Attic API is considered stable. However, that
+# expression is not tested by CI so to not slow down the hot path.
+
+{ stdenv
+, lib
+, craneLib
+, rustPlatform
+, runCommand
+, writeReferencesToFile
+, pkg-config
+, installShellFiles
+, jq
+
+, nix
+, boost
+, darwin
+, libiconv
+}:
+
+let
+  version = "0.1.0";
+
+  ignoredPaths = [ ".github" "target" "book" ];
+
+  src = lib.cleanSourceWith {
+    filter = name: type: !(type == "directory" && builtins.elem (baseNameOf name) ignoredPaths);
+    src = lib.cleanSource ./.;
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+    pkg-config
+    installShellFiles
+  ];
+
+  buildInputs = [
+    nix boost
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.SystemConfiguration
+    libiconv
+  ];
+
+  cargoArtifacts = craneLib.buildDepsOnly {
+    pname = "attic";
+    inherit src nativeBuildInputs buildInputs;
+
+    # By default it's "use-symlink", which causes Crane's `inheritCargoArtifactsHook`
+    # to copy the artifacts using `cp --no-preserve=mode` which breaks the executable
+    # bit of bindgen's build-script binary.
+    #
+    # With `use-zstd`, the cargo artifacts are archived in a `tar.zstd`. This is
+    # actually set if you use `buildPackage` without passing `cargoArtifacts`.
+    installCargoArtifactsMode = "use-zstd";
+  };
+
+  attic = craneLib.buildPackage {
+    pname = "attic";
+    inherit src version nativeBuildInputs buildInputs cargoArtifacts;
+
+    ATTIC_DISTRIBUTOR = "attic";
+
+    # See comment in `attic-tests`
+    doCheck = false;
+
+    postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+      if [[ -f $out/bin/attic ]]; then
+        installShellCompletion --cmd attic \
+          --bash <($out/bin/attic gen-completions bash) \
+          --zsh <($out/bin/attic gen-completions zsh) \
+          --fish <($out/bin/attic gen-completions fish)
+      fi
+    '';
+  };
+
+  # Client-only package.
+  attic-client = attic.overrideAttrs (old: {
+    cargoExtraArgs = (old.cargoExtraArgs or "") + " -p attic-client";
+  });
+
+  # Server-only package with fat LTO enabled.
+  #
+  # Because of Cargo's feature unification, the common `attic` crate always
+  # has the `nix_store` feature enabled if the client and server are built
+  # together, leading to `atticd` linking against `libnixstore` as well. This
+  # package is slimmer with more optimization.
+  #
+  # We don't enable fat LTO in the default `attic` package since it
+  # dramatically increases build time.
+  attic-server = craneLib.buildPackage {
+    pname = "attic-server";
+
+    # We don't pull in the common cargoArtifacts because the feature flags
+    # and LTO configs are different
+    inherit src version nativeBuildInputs buildInputs;
+
+    # See comment in `attic-tests`
+    doCheck = false;
+
+    cargoExtraArgs = "-p attic-server";
+
+    CARGO_PROFILE_RELEASE_LTO = "fat";
+    CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
+  };
+
+  # Attic interacts with Nix directly and its tests require trusted-user access
+  # to nix-daemon to import NARs, which is not possible in the build sandbox.
+  # In the CI pipeline, we build the test executable inside the sandbox, then
+  # run it outside.
+  attic-tests = craneLib.mkCargoDerivation {
+    pname = "attic-tests";
+
+    inherit src version buildInputs cargoArtifacts;
+
+    nativeBuildInputs = nativeBuildInputs ++ [ jq ];
+
+    doCheck = true;
+
+    buildPhaseCargoCommand = "";
+    checkPhaseCargoCommand = "cargoWithProfile test --no-run --message-format=json >cargo-test.json";
+    doInstallCargoArtifacts = false;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/bin
+      jq -r 'select(.reason == "compiler-artifact" and .target.test and .executable) | .executable' <cargo-test.json | \
+        xargs -I _ cp _ $out/bin
+
+      runHook postInstall
+    '';
+  };
+in {
+  inherit cargoArtifacts attic attic-client attic-server attic-tests;
+}
diff --git a/flake.lock b/flake.lock
index 815802b..41bb780 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,32 @@
 {
   "nodes": {
+    "crane": {
+      "inputs": {
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": "rust-overlay"
+      },
+      "locked": {
+        "lastModified": 1672095661,
+        "narHash": "sha256-7NTsdCn3qsvU7A+1/7tY8pxbq0DYy1pFYNpzN6he9lI=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "98894bb39b03bfb379c5e10523cd61160e1ac782",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -49,10 +76,36 @@
     },
     "root": {
       "inputs": {
+        "crane": "crane",
         "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs"
       }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "crane",
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "crane",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1670034122,
+        "narHash": "sha256-EqmuOKucPWtMvCZtHraHr3Q3bgVszq1x2PoZtQkUuEk=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "a0d5773275ecd4f141d792d3a0376277c0fc0b65",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
     }
   },
   "root": "root",
diff --git a/flake.nix b/flake.nix
index 3c2db11..9168057 100644
--- a/flake.nix
+++ b/flake.nix
@@ -5,35 +5,35 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     flake-utils.url = "github:numtide/flake-utils";
 
+    crane = {
+      url = "github:ipetkov/crane";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-compat.follows = "flake-compat";
+      inputs.flake-utils.follows = "flake-utils";
+    };
+
     flake-compat = {
       url = "github:edolstra/flake-compat";
       flake = false;
     };
   };
 
-  outputs = { self, nixpkgs, flake-utils, ... }: let
+  outputs = { self, nixpkgs, flake-utils, crane, ... }: let
     supportedSystems = flake-utils.lib.defaultSystems;
   in flake-utils.lib.eachSystem supportedSystems (system: let
     pkgs = import nixpkgs { inherit system; };
 
+    craneLib = crane.lib.${system};
+    cranePkgs = pkgs.callPackage ./crane.nix { inherit craneLib; };
+
     inherit (pkgs) lib;
   in rec {
     packages = {
       default = packages.attic;
 
-      attic = pkgs.callPackage ./package.nix { };
-      attic-client = packages.attic.override { clientOnly = true; };
+      inherit (cranePkgs) attic attic-client attic-server attic-tests;
 
-      attic-server = let
-        attic-server = pkgs.callPackage ./package.nix {
-          crates = [ "attic-server" ];
-        };
-      in attic-server.overrideAttrs (old: {
-        pname = "attic-server";
-
-        CARGO_PROFILE_RELEASE_LTO = "fat";
-        CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";
-      });
+      attic-nixpkgs = pkgs.callPackage ./package.nix { };
 
       attic-server-image = pkgs.dockerTools.buildImage {
         name = "attic-server";
diff --git a/package.nix b/package.nix
index 042f1ba..fa32296 100644
--- a/package.nix
+++ b/package.nix
@@ -1,3 +1,9 @@
+# This is an alternative package expression of Attic in a nixpkgs-acceptable
+# form. It will be submitted when the Attic API is considered stable.
+#
+# For the expression used for CI as well as distribution from this repo, see
+# `crane.nix`.
+
 { lib, stdenv, rustPlatform
 , pkg-config
 , installShellFiles