diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..79f20566
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "cargo"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "cargo"
+    directory: "/commit_verify"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "cargo"
+    directory: "/commit_verify/derive"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "cargo"
+    directory: "/single_use_seals"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d5625dfa..997b9a66 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,12 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
+      # NOTE: Dont use nix here, everything should be based on the ubuntu-latest
       - name: Install rust stable
         uses: actions-rs/toolchain@v1
         with:
           toolchain: stable
           override: true
-      - name: Default build
+      - name: Latest Ubuntu build check
         uses: actions-rs/cargo@v1
         with:
           command: check
@@ -38,21 +39,12 @@ jobs:
           - all
     steps:
       - uses: actions/checkout@v2
-      - name: Install rust stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-      - name: Feature ${{ matrix.feature }}
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --no-default-features --features=${{ matrix.feature }}
-      - name: Defaults + ${{ matrix.feature }}
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --features=${{ matrix.feature }}
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
+      - name: Check feature ${{ matrix.feature }} only
+        run: nix develop .#stable -c cargo check --no-default-features --features=${{ matrix.feature }}
+      - name: Check feature ${{ matrix.feature }} with defaults
+        run: nix develop .#stable -c cargo check --features=${{ matrix.feature }}
   platforms:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -61,6 +53,7 @@ jobs:
         os: [ ubuntu-20.04, ubuntu-22.04, macos-12, macos-13, windows-2019, windows-2022 ]
     steps:
       - uses: actions/checkout@v2
+      # NOTE: Dont use nix in platform checks everything should based on the host system
       - name: Install rust stable
         uses: actions-rs/toolchain@v1
         with:
@@ -76,16 +69,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        toolchain: [ nightly, beta, stable, 1.69.0 ]
+        toolchain: [ nightly, beta, stable, msrv ]
     steps:
       - uses: actions/checkout@v2
-      - name: Install rust ${{ matrix.toolchain }}
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: ${{ matrix.toolchain }}
-          override: true
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
       - name: All features
-        uses: actions-rs/cargo@v1
-        with:
-          command: check
-          args: --workspace --all-targets --all-features
+        run: nix develop ".#${{ matrix.toolchain }}" -c cargo check --workspace --all-targets --all-features
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 20773195..cbb6d3ae 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -13,39 +13,23 @@ jobs:
   codecov:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          components: rustfmt, llvm-tools-preview
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
       - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --release
-        env:
-          CARGO_INCREMENTAL: "0"
-          RUSTFLAGS: "-Cinstrument-coverage"
-          RUSTDOCFLAGS: "-Cinstrument-coverage"
+        run: nix develop .#codecov -c cargo build --release
       - name: Test
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --all-features --no-fail-fast
-        env:
-          CARGO_INCREMENTAL: "0"
-          RUSTFLAGS: "-Cinstrument-coverage"
-          RUSTDOCFLAGS: "-Cinstrument-coverage"
+        run: nix develop .#codecov -c cargo test --all-features --no-fail-fast --tests
       - name: Install grcov
-        run: if [[ ! -e ~/.cargo/bin/grcov ]]; then cargo install grcov; fi
+        run: nix develop .#codecov -c cargo install grcov
       - name: Generate coverage
-        run: grcov . --binary-path target/debug/deps/ -s . -t lcov --branch --ignore-not-existing --ignore '../**' --ignore '/*' -o coverage.lcov
+        run: nix develop .#codecov -c grcov . --binary-path target/debug/deps/ -s . -t lcov --branch --ignore-not-existing --ignore '../**' --ignore '/*' -o coverage.lcov
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v4
         with:
           files: ./coverage.lcov
           flags: rust
-          fail_ci_if_error: true
+          # TODO: set true when CODECOV_TOKEN is set
+          fail_ci_if_error: false
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3f51bde0..44766581 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,44 +14,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Install rustc nightly
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: nightly
-          override: true
-          components: rustfmt
-      - uses: actions-rs/cargo@v1
-        name: Formatting
-        with:
-          command: fmt
-          args: --all -- --check
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
+      - name: Formatting
+        run: nix develop .#nightly -c cargo fmt --all -- --check
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Install rustc stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
-          components: clippy
-      - uses: actions-rs/cargo@v1
-        name: Clippy
-        with:
-          command: clippy
-          args: --workspace --all-features --all-targets -- -D warnings
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
+      - name: Clippy
+        run: nix develop .#stable -c cargo clippy --workspace --all-features --all-targets -- -D warnings
   doc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Install rustc nightly
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: nightly
-          override: true
-          components: rust-docs
-      - uses: actions-rs/cargo@v1
-        name: Doc
-        with:
-          command: doc
-          args: --workspace --all-features
+      - uses: actions/checkout@v4
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
+      - name: Doc
+        run: nix develop .#nightly -c cargo doc --workspace --all-features
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3705ca1a..10e84b4c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,13 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Install latest stable
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-          override: true
+      - name: Install Nix
+        uses: cachix/install-nix-action@v26
       - name: Build & test
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: --workspace --all-features --no-fail-fast
+        run: nix develop .#stable -c cargo test --workspace --all-features --no-fail-fast
diff --git a/Cargo.toml b/Cargo.toml
index 6e620dae..a5ae277a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,7 +17,7 @@ version = "0.11.0-beta.5"
 authors = ["Dr Maxim Orlovsky <orlovsky@lnp-bp.org>"]
 homepage = "https://github.com/LNP-BP"
 repository = "https://github.com/LNP-BP/client_side_validation"
-rust-version = "1.69" # Due to TOML in amplify dependency
+rust-version = "1.69.0" # Due to TOML in amplify dependency
 edition = "2021"
 license = "Apache-2.0"
 
diff --git a/commit_verify/src/mpc/block.rs b/commit_verify/src/mpc/block.rs
index 70e51383..d5afa7fa 100644
--- a/commit_verify/src/mpc/block.rs
+++ b/commit_verify/src/mpc/block.rs
@@ -648,7 +648,7 @@ impl MerkleProof {
     /// Returns the root of the merkle path.
     ///
     /// If the MPC proof contains only a single message returns None
-    pub fn merkle_root(&self) -> Option<MerkleHash> { self.path.get(0).copied() }
+    pub fn merkle_root(&self) -> Option<MerkleHash> { self.path.first().copied() }
 
     /// Convolves the proof with the `message` under the given `protocol_id`,
     /// producing [`Commitment`].
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 00000000..0da39090
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,85 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1713714899,
+        "narHash": "sha256-+z/XjO3QJs5rLE5UOf015gdVauVRQd2vZtsFkaXBq2Y=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "6143fc5eeb9c4f00163267708e26191d1e918932",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "rust-overlay": "rust-overlay"
+      }
+    },
+    "rust-overlay": {
+      "inputs": {
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1713838472,
+        "narHash": "sha256-lCdDz6/YgyXdFRHall3P+dCETRpfz3Pi9eREnA9RX6k=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "28a9436d356181603fb0d333565431c3d952f299",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 00000000..6aaf670a
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,68 @@
+{
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+    };
+
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, rust-overlay, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        overlays = [ (import rust-overlay) ];
+        pkgs = import nixpkgs {
+          inherit system overlays;
+        };
+
+        cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
+
+        stableWithLlvm = pkgs.rust-bin.nightly.latest.default.override {
+          extensions = [ "rustfmt" "llvm-tools-preview" ];
+          targets = [ ];
+        };
+      in
+      with pkgs;
+      {
+        devShells = rec {
+          default = msrv;
+
+          msrv = mkShell {
+            buildInputs = [
+              rust-bin.stable."${cargoToml.workspace.package."rust-version"}".default
+            ];
+          };
+
+          stable = mkShell {
+            buildInputs = [
+              rust-bin.stable.latest.default
+            ];
+          };
+
+          beta = mkShell {
+            buildInputs = [
+              rust-bin.beta.latest.default
+            ];
+          };
+
+          nightly = mkShell {
+            buildInputs = [
+              rust-bin.nightly.latest.default
+            ];
+          };
+
+          codecov = mkShell {
+            buildInputs = [
+              stableWithLlvm
+            ];
+            CARGO_INCREMENTAL = "0";
+            RUSTFLAGS = "-Cinstrument-coverage";
+            RUSTDOCFLAGS = "-Cinstrument-coverage";
+          };
+        };
+      }
+    );
+}