diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index fec6cdb87..fd3339629 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -93,7 +93,7 @@ jobs:
         CARGO_RESOLVER_INCOMPATIBLE_RUST_VERSIONS: fallback
     - name: Get MSRV from manifest file
       id: msrv
-      run: echo "version=$(yq '.workspace.package.rust-version' Cargo.toml)" >> $GITHUB_OUTPUT
+      run: echo "version=$(yq '.workspace.package.rust-version' Cargo.toml)" >> "$GITHUB_OUTPUT"
     - uses: hecrj/setup-rust-action@v2
       with:
         rust-version: ${{ steps.msrv.outputs.version }}
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 000000000..f257c3ba2
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,181 @@
+{
+  "nodes": {
+    "fenix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-analyzer-src": "rust-analyzer-src"
+      },
+      "locked": {
+        "lastModified": 1746081462,
+        "narHash": "sha256-WmJBaktb33WwqNn5BwdJghAoiBnvnPhgHSBksTrF5K8=",
+        "owner": "nix-community",
+        "repo": "fenix",
+        "rev": "e3be528e4f03538852ba49b413ec4ac843edeb60",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "fenix",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1743550720,
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742649964,
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1745930157,
+        "narHash": "sha256-y3h3NLnzRSiUkYpnfvnS669zWZLoqqI6NprtLQ+5dck=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "46e634be05ce9dc6d4db8e664515ba10b78151ae",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1743296961,
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "fenix": "fenix",
+        "flake-parts": "flake-parts",
+        "git-hooks": "git-hooks",
+        "nixpkgs": "nixpkgs",
+        "treefmt-nix": "treefmt-nix"
+      }
+    },
+    "rust-analyzer-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1746024678,
+        "narHash": "sha256-Q5J7+RoTPH4zPeu0Ka7iSXtXty228zKjS0Ed4R+ohpA=",
+        "owner": "rust-lang",
+        "repo": "rust-analyzer",
+        "rev": "5d66d45005fef79751294419ab9a9fa304dfdf5c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "rust-lang",
+        "ref": "nightly",
+        "repo": "rust-analyzer",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1745929750,
+        "narHash": "sha256-k5ELLpTwRP/OElcLpNaFWLNf8GRDq4/eHBmFy06gGko=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "82bf32e541b30080d94e46af13d46da0708609ea",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 000000000..790151849
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,73 @@
+{
+  description = "Description for the project";
+
+  inputs = {
+    flake-parts.url = "github:hercules-ci/flake-parts";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    fenix = {
+      url = "github:nix-community/fenix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    git-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs = { nixpkgs.follows = "nixpkgs"; };
+    };
+
+    treefmt-nix = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs = inputs@{ self, flake-parts, ... }:
+    flake-parts.lib.mkFlake { inherit inputs; } {
+      imports = [ inputs.git-hooks.flakeModule inputs.treefmt-nix.flakeModule ];
+      systems =
+        [ "x86_64-linux" "aarch64-linux" "aarch64-darwin" "x86_64-darwin" ];
+      perSystem = { config, pkgs, system, ... }:
+        let rustToolchain = pkgs.fenix.stable;
+        in {
+          _module.args.pkgs = import inputs.nixpkgs {
+            inherit system;
+            overlays = [ inputs.fenix.overlays.default ];
+            config = { };
+          };
+
+          formatter = config.treefmt.build.wrapper;
+          checks.formatting = config.treefmt.build.check self;
+
+          pre-commit = {
+            check.enable = true;
+            settings.hooks = {
+              actionlint.enable = true;
+              shellcheck.enable = true;
+              treefmt.enable = true;
+            };
+          };
+
+          treefmt = {
+            settings = { rustfmt.enable = true; };
+            projectRootFile = ".git/config";
+            flakeCheck = false; # Covered by git-hooks check
+          };
+
+          devShells.default = pkgs.mkShell {
+            packages = with pkgs; [
+              nixd
+              nixfmt
+
+              (rustToolchain.withComponents [
+                "cargo"
+                "clippy"
+                "rust-src"
+                "rustc"
+                "rustfmt"
+                "rust-analyzer"
+              ])
+              protobuf
+            ];
+          };
+        };
+    };
+}
diff --git a/interop/test.sh b/interop/test.sh
index 1814b2df4..6208a8117 100755
--- a/interop/test.sh
+++ b/interop/test.sh
@@ -47,7 +47,7 @@ TLS_CRT="interop/data/server1.pem"
 TLS_KEY="interop/data/server1.key"
 
 # run the test server
-./"${SERVER}" ${ARG} --tls_cert_file $TLS_CRT --tls_key_file $TLS_KEY &
+./"${SERVER}" "${ARG}" --tls_cert_file $TLS_CRT --tls_key_file $TLS_KEY &
 SERVER_PID=$!
 echo ":; started grpc-go test server."
 
@@ -57,12 +57,12 @@ trap 'echo ":; killing test server"; kill ${SERVER_PID};' EXIT
 
 sleep 1
 
-./target/debug/client --test_case="${JOINED_TEST_CASES}" ${ARG}
+./target/debug/client --test_case="${JOINED_TEST_CASES}" "${ARG}"
 
-echo ":; killing test server"; kill ${SERVER_PID};
+echo ":; killing test server"; kill "${SERVER_PID}";
 
 # run the test server
-./target/debug/server ${ARG} &
+./target/debug/server "${ARG}" &
 SERVER_PID=$!
 echo ":; started tonic test server."
 
@@ -72,7 +72,7 @@ trap 'echo ":; killing test server"; kill ${SERVER_PID};' EXIT
 
 sleep 1
 
-./target/debug/client --test_case="${JOINED_TEST_CASES}" ${ARG}
+./target/debug/client --test_case="${JOINED_TEST_CASES}" "${ARG}"
 
 TLS_ARGS=""
 
@@ -81,5 +81,5 @@ if [ -n "${ARG}" ]; then
 fi
 
 for CASE in "${TEST_CASES[@]}"; do
-  interop/bin/client_${OS}_amd64${EXT} --test_case="${CASE}" ${TLS_ARGS}
+  interop/bin/client_${OS}_amd64${EXT} --test_case="${CASE}" "${TLS_ARGS}"
 done
diff --git a/interop/update_binaries.sh b/interop/update_binaries.sh
index 79d3ba4ba..c11f93728 100755
--- a/interop/update_binaries.sh
+++ b/interop/update_binaries.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 set -e
 
 # This script updates server and client go binaries for interop tests.
@@ -30,4 +31,4 @@ for ROLE in $ROLES; do
   done
 done
 
-rm -rf ../grpc-go
\ No newline at end of file
+rm -rf ../grpc-go
diff --git a/prepare-release.sh b/prepare-release.sh
index 1c5254bd4..f5e13bb63 100755
--- a/prepare-release.sh
+++ b/prepare-release.sh
@@ -14,7 +14,7 @@ fi
 
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
 VERSION="$1"
-MINOR="$( echo ${VERSION} | cut -d\. -f1-2 )"
+MINOR="$( echo "${VERSION}" | cut -d\. -f1-2 )"
 
 VERSION_MATCHER="([a-z0-9\\.-]+)"
 TONIC_CRATE_MATCHER="(tonic|tonic-[a-z]+)"