diff --git a/WORKSPACE.bazel b/WORKSPACE.bazel
index 672ad23ac..f1bcd8396 100644
--- a/WORKSPACE.bazel
+++ b/WORKSPACE.bazel
@@ -1,5 +1,23 @@
 workspace(name = "constellation")
 
+# nixpkgs deps
+load("//bazel/toolchains:nixpkgs_deps.bzl", "nixpkgs_deps")
+
+nixpkgs_deps()
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:repositories.bzl", "rules_nixpkgs_dependencies")
+
+rules_nixpkgs_dependencies()
+
+load("@io_tweag_rules_nixpkgs//nixpkgs:nixpkgs.bzl", "nixpkgs_flake_package")
+
+nixpkgs_flake_package(
+    name = "mkosi",
+    nix_flake_file = "//:flake.nix",
+    nix_flake_lock_file = "//:flake.lock",
+    package = "mkosi",
+)
+
 # Python toolchain
 load("//bazel/toolchains:python_deps.bzl", "python_deps")
 
diff --git a/bazel/toolchains/nixpkgs_deps.bzl b/bazel/toolchains/nixpkgs_deps.bzl
new file mode 100644
index 000000000..c471e0e81
--- /dev/null
+++ b/bazel/toolchains/nixpkgs_deps.bzl
@@ -0,0 +1,15 @@
+"""Bazel rules for building OCI images"""
+
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def nixpkgs_deps():
+    http_archive(
+        name = "io_tweag_rules_nixpkgs",
+        sha256 = "1eb0ef4f8388a9b53f99587a6282250852a03eab3160313e584ada7005a7ab53",
+        strip_prefix = "rules_nixpkgs-ee5c44a5bc470d13699960f493d42ed4c4d806af",
+        urls = [
+            "https://cdn.confidential.cloud/constellation/cas/sha256/1eb0ef4f8388a9b53f99587a6282250852a03eab3160313e584ada7005a7ab53",
+            "https://github.com/tweag/rules_nixpkgs/archive/ee5c44a5bc470d13699960f493d42ed4c4d806af.tar.gz",
+        ],
+        type = "tar.gz",
+    )