diff --git a/.gitignore b/.gitignore
index 18db0380..70578e91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,4 +8,5 @@ venv/
 nixos/.direnv
 nixos/.deploy-gc
 nixos/result
+bundlewrap/.direnv
 .vscode
diff --git a/bundlewrap/.envrc b/bundlewrap/.envrc
new file mode 100644
index 00000000..3550a30f
--- /dev/null
+++ b/bundlewrap/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/bundlewrap/flake.lock b/bundlewrap/flake.lock
new file mode 100644
index 00000000..7be1d96c
--- /dev/null
+++ b/bundlewrap/flake.lock
@@ -0,0 +1,57 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 0,
+        "narHash": "sha256-G1wpOEqpIGuUoTzwPW4kbDnfjdaSeTvB34hgNMMnGnM=",
+        "path": "/nix/store/1jqlvpl60z5225csy1n27w0d45g2gmyv-source",
+        "type": "path"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/bundlewrap/flake.nix b/bundlewrap/flake.nix
new file mode 100644
index 00000000..8ebc212b
--- /dev/null
+++ b/bundlewrap/flake.nix
@@ -0,0 +1,29 @@
+{
+  description = "c3voc bundlewrap";
+
+  inputs.flake-utils.url = "github:numtide/flake-utils";
+
+  outputs = { self, nixpkgs, flake-utils } @ inputs: flake-utils.lib.eachSystem ([
+    "x86_64-linux"
+    "x86_64-darwin"
+    "aarch64-linux"
+    "aarch64-darwin"
+  ]) (system:
+    let
+      pkgs = (import nixpkgs { inherit system; });
+    in {
+      legacyPackages = pkgs;
+      devShells.default = pkgs.mkShell {
+        buildInputs = with pkgs; [
+          curl
+          rsync
+          (python3.withPackages (py: [
+            py.bundlewrap
+            py.bundlewrap-keepass
+
+            py.virtualenv
+          ]))
+        ];
+      };
+    });
+}
diff --git a/bundlewrap/requirements.txt b/bundlewrap/requirements.txt
index a25325c0..a422b258 100644
--- a/bundlewrap/requirements.txt
+++ b/bundlewrap/requirements.txt
@@ -1,2 +1,2 @@
-bundlewrap~=4.20.0
+bundlewrap~=4.0, >=4.20.0
 bundlewrap-keepass