{
  description = "Aggregate and sync events between CalDAV, Google Calendar and iCal feeds";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs =
    { self, nixpkgs }:
    let
      systems = [
        "x86_64-linux"
        "aarch64-linux"
      ];
      forEachSystem = nixpkgs.lib.genAttrs systems;
      cargoToml = builtins.fromTOML (builtins.readFile ./Cargo.toml);
    in
    {
      packages = forEachSystem (
        system:
        let
          pkgs = import nixpkgs { inherit system; };

          # nixpkgs currently ships pimsync 0.5.9, but `discover`'s output
          # format is undocumented and changed between 0.5.9 and 0.5.11 —
          # calcalist's parser only understands the newer shape (see
          # SUPPORTED_PATCH_MIN in src/pimsync.rs). Build the exact version
          # rather than trust whatever nixpkgs happens to carry.
          pimsync0_5_11 = pkgs.rustPlatform.buildRustPackage (finalAttrs: {
            pname = "pimsync";
            version = "0.5.11";
            src = pkgs.fetchFromSourcehut {
              owner = "~whynothugo";
              repo = "pimsync";
              rev = "v${finalAttrs.version}";
              hash = "sha256-iMdBqSSguViF+54e47IGV8hH3qvTxcNkWkmND1QAAxw=";
            };
            cargoHash = "sha256-dvkZ047eJnvYvyH1iW1NJo3Uv0L2T7waPYKN12bi+dA=";

            # Skips build.rs's `git describe` call, which has nothing to
            # describe once fetched as a plain source tarball.
            env.PIMSYNC_VERSION = finalAttrs.version;

            nativeBuildInputs = [ pkgs.pkg-config ];
            buildInputs = [ pkgs.sqlite ];
            doCheck = false;
          });
        in
        rec {
          calcalist = pkgs.rustPlatform.buildRustPackage {
            pname = "calcalist";
            version = cargoToml.package.version;
            src = pkgs.lib.cleanSource ./.;
            cargoLock.lockFile = ./Cargo.lock;

            # tests/caldav.rs spins up radicale and pimsync as real
            # processes; it's a dev-time integration gate (devbox run
            # check), not something a package build should re-run.
            doCheck = false;

            nativeBuildInputs = [ pkgs.makeWrapper ];

            # Ensures the pimsync calcalist finds is the one it was tested
            # against, regardless of what else is on the user's PATH.
            postInstall = ''
              wrapProgram $out/bin/calcalist \
                --prefix PATH : ${pkgs.lib.makeBinPath [ pimsync0_5_11 ]}
            '';

            meta = {
              description = cargoToml.package.description;
              license = pkgs.lib.licenses.mit;
              mainProgram = "calcalist";
              platforms = pkgs.lib.platforms.linux;
            };
          };
          default = calcalist;
        }
      );

      apps = forEachSystem (system: rec {
        calcalist = {
          type = "app";
          program = "${self.packages.${system}.calcalist}/bin/calcalist";
        };
        default = calcalist;
      });
    };
}