{
  description = "att_lock — Android-style pattern screen locker for wlroots compositors (ext-session-lock-v1 + PAM)";

  inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";

  outputs = { self, nixpkgs }:
    let
      systems = [ "x86_64-linux" "aarch64-linux" ];
      forAll = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});

      nativeDeps = pkgs: with pkgs; [ meson ninja pkg-config wayland-scanner ];
      # libxcrypt provides crypt.h + crypt_gensalt; pam is linux-pam.
      libDeps = pkgs: with pkgs; [ wayland cairo libxkbcommon pam libxcrypt ];

      # Copy only the sources, never local build artifacts (build/, result).
      # This repo isn't tracked by git, so `./.` would otherwise vacuum in a
      # stale meson build dir and break the sandboxed build.
      cleanSrc = pkgs: pkgs.lib.cleanSourceWith {
        src = pkgs.lib.cleanSource ./.;
        filter = path: type:
          let base = baseNameOf path;
          in base != "build" && !(pkgs.lib.hasPrefix "result" base);
      };

      mkPackage = pkgs: pkgs.stdenv.mkDerivation {
        pname = "att_lock";
        version = "0.1.0";
        src = cleanSrc pkgs;
        nativeBuildInputs = nativeDeps pkgs;
        buildInputs = libDeps pkgs;
        meta = with pkgs.lib; {
          description = "Android-style 4x4 pattern screen locker for wlroots compositors";
          license = licenses.mit;
          platforms = platforms.linux;
          mainProgram = "att_lock";
        };
      };
    in
    {
      packages = forAll (pkgs: {
        default = mkPackage pkgs;
        att_lock = mkPackage pkgs;
      });

      devShells = forAll (pkgs: {
        default = pkgs.mkShell {
          nativeBuildInputs = nativeDeps pkgs;
          buildInputs = libDeps pkgs;
        };
      });

      formatter = forAll (pkgs: pkgs.nixpkgs-fmt);
    };
}