diff --git a/.gitignore b/.gitignore
index 05b34134..c2755201 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,3 @@
-build/
-runtime/src/pl.rs
-target/
+result
+examples/*.elf
 __pycache__
diff --git a/README.md b/README.md
deleted file mode 100644
index 39428402..00000000
--- a/README.md
+++ /dev/null
@@ -1,6 +0,0 @@
-Build with:
-
-```shell
-cargo xbuild -p runtime --release
-cargo xbuild -p szl --release
-```
diff --git a/default.nix b/default.nix
new file mode 100644
index 00000000..3db24b24
--- /dev/null
+++ b/default.nix
@@ -0,0 +1,72 @@
+{
+  mozillaOverlay ? import (builtins.fetchTarball https://github.com/mozilla/nixpkgs-mozilla/archive/master.tar.gz),
+}:
+
+let
+  pkgs = import <nixpkgs> { overlays = [ mozillaOverlay ]; };
+  artiq-fast = <artiq-fast>;
+  rustPlatform = (import ./rustPlatform.nix { inherit pkgs; });
+  buildFirmware = { name, src }:
+    rustPlatform.buildRustPackage rec {
+      inherit name;
+      version = "0.1.0";
+
+      inherit src;
+      cargoSha256 = (import "${src}/cargosha256.nix");
+
+      nativeBuildInputs = [ pkgs.cargo-xbuild pkgs.llvm_9 pkgs.clang_9 ];
+      buildPhase = ''
+        export XARGO_RUST_SRC="${rustPlatform.rust.rustc.src}/src"
+        export CARGO_HOME=$(mktemp -d cargo-home.XXX)
+        cargo xbuild --release -p ${name}
+      '';
+
+      doCheck = false;
+      installPhase = ''
+        mkdir -p $out $out/nix-support
+        cp target/armv7-none-eabihf/release/${name} $out/${name}.elf
+        echo file binary-dist $out/${name}.elf >> $out/nix-support/hydra-build-products
+      '';
+      dontFixup = true;
+    };
+
+    artiqpkgs = import "${artiq-fast}/default.nix" { inherit pkgs; };
+    vivado = import "${artiq-fast}/vivado.nix" { inherit pkgs; };
+in
+  rec {
+    zc706-runtime-src = pkgs.runCommand "zc706-runtime-src"
+      { buildInputs = [ 
+        (pkgs.python3.withPackages(ps: (with artiqpkgs; [ migen migen-axi misoc artiq ])))
+      ]; }
+      ''
+        cp --no-preserve=mode,ownership -R ${./firmware} $out
+        cd $out/runtime/src
+        python ${./zc706.py} rustif
+      '';
+    zc706-runtime = buildFirmware { name = "runtime"; src = zc706-runtime-src; };
+    zc706-szl-src = pkgs.runCommand "zc706-szl-src"
+      { nativeBuildInputs = [ pkgs.llvm_9 ]; }
+      ''
+        cp --no-preserve=mode,ownership -R ${./firmware} $out
+        llvm-objcopy -O binary ${zc706-runtime}/runtime.elf $out/szl/src/payload.bin
+        lzma $out/szl/src/payload.bin
+      '';
+    zc706-szl = buildFirmware { name = "szl"; src = zc706-szl-src; };
+    zc706-gateware = pkgs.runCommand "zc706-gateware"
+      { buildInputs = [ 
+        (pkgs.python3.withPackages(ps: (with artiqpkgs; [ migen migen-axi misoc artiq ])))
+        vivado
+      ]; }
+      ''
+        python ${./zc706.py} gateware
+        mkdir -p $out $out/nix-support
+        cp build/top.bit $out
+        echo file binary-dist $out/top.bit >> $out/nix-support/hydra-build-products
+      '';
+    zc706-jtag = pkgs.runCommand "zc706-jtag" {}
+      ''
+        mkdir $out
+        ln -s ${zc706-szl}/szl $out
+        ln -s ${zc706-gateware}/top.bit $out
+      '';
+  }
diff --git a/.cargo/config b/firmware/.cargo/config
similarity index 100%
rename from .cargo/config
rename to firmware/.cargo/config
diff --git a/Cargo.lock b/firmware/Cargo.lock
similarity index 100%
rename from Cargo.lock
rename to firmware/Cargo.lock
diff --git a/Cargo.toml b/firmware/Cargo.toml
similarity index 100%
rename from Cargo.toml
rename to firmware/Cargo.toml
diff --git a/armv7-none-eabihf.json b/firmware/armv7-none-eabihf.json
similarity index 100%
rename from armv7-none-eabihf.json
rename to firmware/armv7-none-eabihf.json
diff --git a/firmware/cargosha256.nix b/firmware/cargosha256.nix
new file mode 100644
index 00000000..6fdc18cd
--- /dev/null
+++ b/firmware/cargosha256.nix
@@ -0,0 +1 @@
+"1mfprkcq4cr4jiihy1qn8q8qymxwhafh90vyr3i4brj4aq5kksn1"
diff --git a/libdyld/Cargo.toml b/firmware/libdyld/Cargo.toml
similarity index 100%
rename from libdyld/Cargo.toml
rename to firmware/libdyld/Cargo.toml
diff --git a/libdyld/src/elf.rs b/firmware/libdyld/src/elf.rs
similarity index 100%
rename from libdyld/src/elf.rs
rename to firmware/libdyld/src/elf.rs
diff --git a/libdyld/src/file.rs b/firmware/libdyld/src/file.rs
similarity index 100%
rename from libdyld/src/file.rs
rename to firmware/libdyld/src/file.rs
diff --git a/libdyld/src/image.rs b/firmware/libdyld/src/image.rs
similarity index 100%
rename from libdyld/src/image.rs
rename to firmware/libdyld/src/image.rs
diff --git a/libdyld/src/lib.rs b/firmware/libdyld/src/lib.rs
similarity index 100%
rename from libdyld/src/lib.rs
rename to firmware/libdyld/src/lib.rs
diff --git a/libdyld/src/reloc.rs b/firmware/libdyld/src/reloc.rs
similarity index 100%
rename from libdyld/src/reloc.rs
rename to firmware/libdyld/src/reloc.rs
diff --git a/runtime/Cargo.toml b/firmware/runtime/Cargo.toml
similarity index 100%
rename from runtime/Cargo.toml
rename to firmware/runtime/Cargo.toml
diff --git a/runtime/build.rs b/firmware/runtime/build.rs
similarity index 100%
rename from runtime/build.rs
rename to firmware/runtime/build.rs
diff --git a/runtime/link.x b/firmware/runtime/link.x
similarity index 100%
rename from runtime/link.x
rename to firmware/runtime/link.x
diff --git a/runtime/src/comms.rs b/firmware/runtime/src/comms.rs
similarity index 100%
rename from runtime/src/comms.rs
rename to firmware/runtime/src/comms.rs
diff --git a/runtime/src/kernel.rs b/firmware/runtime/src/kernel.rs
similarity index 100%
rename from runtime/src/kernel.rs
rename to firmware/runtime/src/kernel.rs
diff --git a/runtime/src/main.rs b/firmware/runtime/src/main.rs
similarity index 100%
rename from runtime/src/main.rs
rename to firmware/runtime/src/main.rs
diff --git a/runtime/src/moninj.rs b/firmware/runtime/src/moninj.rs
similarity index 100%
rename from runtime/src/moninj.rs
rename to firmware/runtime/src/moninj.rs
diff --git a/runtime/src/proto.rs b/firmware/runtime/src/proto.rs
similarity index 100%
rename from runtime/src/proto.rs
rename to firmware/runtime/src/proto.rs
diff --git a/runtime/src/rtio.rs b/firmware/runtime/src/rtio.rs
similarity index 100%
rename from runtime/src/rtio.rs
rename to firmware/runtime/src/rtio.rs
diff --git a/szl/Cargo.toml b/firmware/szl/Cargo.toml
similarity index 100%
rename from szl/Cargo.toml
rename to firmware/szl/Cargo.toml
diff --git a/szl/build.rs b/firmware/szl/build.rs
similarity index 68%
rename from szl/build.rs
rename to firmware/szl/build.rs
index 57a0b117..971a2917 100644
--- a/szl/build.rs
+++ b/firmware/szl/build.rs
@@ -5,20 +5,8 @@ use std::io::Write;
 use std::path::{Path, PathBuf};
 
 fn main() {
-    // FIXME: this is dirty and unreliable. How to depend on the output of the runtime build?
-    let payload = "../target/armv7-none-eabihf/release/runtime";
-
     let out = env::var("OUT_DIR").unwrap();
     let out_dir = &PathBuf::from(&out);
-    let status = Command::new("llvm-objcopy")
-                              .args(&["-O", "binary", payload, &format!("{}/payload.bin", out)])
-                              .status().unwrap();
-    assert!(status.success());
-    let status = Command::new("lzma")
-                              .args(&["--keep", "-f", &format!("{}/payload.bin", out)])
-                              .status().unwrap();
-    assert!(status.success());
-    println!("cargo:rerun-if-changed={}", payload);
 
     let status = Command::new("clang")
                               .args(&["-target", "armv7-unknown-linux", "-fno-stack-protector",
diff --git a/szl/link.x b/firmware/szl/link.x
similarity index 100%
rename from szl/link.x
rename to firmware/szl/link.x
diff --git a/szl/src/main.rs b/firmware/szl/src/main.rs
similarity index 94%
rename from szl/src/main.rs
rename to firmware/szl/src/main.rs
index 1a8fb656..5d2a245a 100644
--- a/szl/src/main.rs
+++ b/firmware/szl/src/main.rs
@@ -39,7 +39,7 @@ pub fn main_core0() {
     libboard_zynq::stdio::drop_uart(); // reinitialize UART after clocking change
     let mut ddr = zynq::ddr::DdrRam::new();
 
-    let payload = include_bytes!(concat!(env!("OUT_DIR"), "/payload.bin.lzma"));
+    let payload = include_bytes!("payload.bin.lzma");
     info!("decompressing payload");
     let result = unsafe {
         unlzma_simple(payload.as_ptr(), payload.len() as i32, ddr.ptr(), lzma_error)
diff --git a/szl/src/unlzma.c b/firmware/szl/src/unlzma.c
similarity index 100%
rename from szl/src/unlzma.c
rename to firmware/szl/src/unlzma.c
diff --git a/remote_run.sh b/remote_run.sh
index dfccd2e8..5710795e 100755
--- a/remote_run.sh
+++ b/remote_run.sh
@@ -8,6 +8,6 @@ TARGET_FOLDER=/tmp/zynq-\$USER
 
 ssh $TARGET_HOST "mkdir -p $TARGET_FOLDER"
 rsync openocd/* $TARGET_HOST:$TARGET_FOLDER
-rsync target/armv7-none-eabihf/release/szl $TARGET_HOST:$TARGET_FOLDER
-rsync build/top.bit $TARGET_HOST:$TARGET_FOLDER
+rsync result/szl $TARGET_HOST:$TARGET_FOLDER
+rsync result/top.bit $TARGET_HOST:$TARGET_FOLDER
 ssh $TARGET_HOST "cd $TARGET_FOLDER; openocd -f zc706.cfg -c 'pld load 0 top.bit; load_image szl; resume 0; exit'"
diff --git a/runtime.bin b/runtime.bin
deleted file mode 100755
index 82fe7ef3..00000000
Binary files a/runtime.bin and /dev/null differ
diff --git a/rustPlatform.nix b/rustPlatform.nix
new file mode 100644
index 00000000..fd17d56e
--- /dev/null
+++ b/rustPlatform.nix
@@ -0,0 +1,24 @@
+{ pkgs }:
+
+let
+  rustcSrc = pkgs.fetchgit {
+    url = "https://github.com/rust-lang/rust.git";
+    # master of 2020-04-10
+    rev = "94d346360da50f159e0dc777dc9bc3c5b6b51a00";
+    sha256 = "1hcqdz4w2vqb12rrqqcjbfs5s0w4qwjn7z45d1zh0fzncdcf6f7d";
+    fetchSubmodules = true;
+  };
+  rustManifest = ./channel-rust-nightly.toml;
+
+  targets = [];
+  rustChannelOfTargets = _channel: _date: targets:
+    (pkgs.lib.rustLib.fromManifestFile rustManifest {
+      inherit (pkgs) stdenv fetchurl patchelf;
+    }).rust.override { inherit targets; };
+  rust =
+    rustChannelOfTargets "nightly" null targets;
+in
+  pkgs.recurseIntoAttrs (pkgs.makeRustPlatform {
+    rustc = rust // { src = rustcSrc; };
+    cargo = rust;
+  })
diff --git a/shell.nix b/shell.nix
deleted file mode 100644
index f4f429dc..00000000
--- a/shell.nix
+++ /dev/null
@@ -1,50 +0,0 @@
-let
-  mozillaOverlay = import (builtins.fetchTarball "https://github.com/mozilla/nixpkgs-mozilla/archive/master.tar.gz");
-  artiq-fast = builtins.fetchTarball "https://nixbld.m-labs.hk/channel/custom/artiq/fast-beta/artiq-fast/nixexprs.tar.xz";
-
-  pkgs = import <nixpkgs> { overlays = [ mozillaOverlay ]; };
-
-  rustcSrc = pkgs.fetchgit {
-    url = "https://github.com/rust-lang/rust.git";
-    # master of 2020-04-10
-    rev = "94d346360da50f159e0dc777dc9bc3c5b6b51a00";
-    sha256 = "1hcqdz4w2vqb12rrqqcjbfs5s0w4qwjn7z45d1zh0fzncdcf6f7d";
-    fetchSubmodules = true;
-  };
-  rustManifest = ./channel-rust-nightly.toml;
-
-  targets = [];
-  rustChannelOfTargets = _channel: _date: targets:
-    (pkgs.lib.rustLib.fromManifestFile rustManifest {
-      inherit (pkgs) stdenv fetchurl patchelf;
-    }).rust.override { inherit targets; };
-  rust =
-    rustChannelOfTargets "nightly" null targets;
-  rustPlatform = pkgs.recurseIntoAttrs (pkgs.makeRustPlatform {
-    rustc = rust // { src = rustcSrc; };
-    cargo = rust;
-  });
-
-  artiqpkgs = import "${artiq-fast}/default.nix" { inherit pkgs; };
-  vivado = import "${artiq-fast}/vivado.nix" { inherit pkgs; };
-in
-  pkgs.stdenv.mkDerivation {
-    name = "artiq-zynq-env";
-    buildInputs = [
-      rustPlatform.rust.rustc
-      rustPlatform.rust.cargo
-      rustcSrc
-      pkgs.clang_9
-      pkgs.cacert
-      pkgs.cargo-xbuild
-
-      pkgs.openssh pkgs.rsync
-
-      (pkgs.python3.withPackages(ps: (with artiqpkgs; [ migen migen-axi misoc artiq ])))
-      vivado
-      pkgs.llvm_9
-      pkgs.lld_9
-    ];
-
-    XARGO_RUST_SRC = "${rustcSrc}/src";
-  }
diff --git a/zc706.py b/zc706.py
index c6cd7d82..06f6388b 100755
--- a/zc706.py
+++ b/zc706.py
@@ -1,7 +1,6 @@
 #!/usr/bin/env python
 
 import argparse
-import os
 
 from migen import *
 
@@ -71,7 +70,7 @@ def main():
         if action == "gateware":
             soc.build()
         elif action == "rustif":
-            write_csr_file(soc, os.path.join("runtime", "src", "pl.rs"))
+            write_csr_file(soc, "pl.rs")
         else:
             raise ValueError("invalid action", action)