nix: Use rustup toolchain

Wire up `crane` and `rust-overlay` to allow the `devShell` to take
advantage of the `rust-toolchain.toml` definitions, and provide Nix
developers with the correct toolchain.

flake.lock

@@ -17,6 +17,21 @@
       }
     },
     "crane": {
+      "locked": {
+        "lastModified": 1779130139,
+        "narHash": "sha256-BLrtr42azquO7MdGFU5a7KiMl3YpFlTeIXqy1fT5GlQ=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "edb38893982a3338972bb4a2ec7ce7c29ba10fd9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
+    "crane_2": {
       "locked": {
         "lastModified": 1771121070,
         "narHash": "sha256-aIlv7FRXF9q70DNJPI237dEDAznSKaXmL5lfK/Id/bI=",
@@ -131,7 +146,7 @@
     "heartwood": {
       "inputs": {
         "advisory-db": "advisory-db",
-        "crane": "crane",
+        "crane": "crane_2",
         "flake-utils": "flake-utils_2",
         "git-hooks": "git-hooks",
         "nixpkgs": [
@@ -207,6 +222,7 @@
     },
     "root": {
       "inputs": {
+        "crane": "crane",
         "flake-utils": "flake-utils",
         "heartwood": "heartwood",
         "nixpkgs": "nixpkgs",

flake.nix

@@ -3,6 +3,7 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
     flake-utils.url = "github:numtide/flake-utils";
+    crane.url = "github:ipetkov/crane";
     rust-overlay = {
       url = "github:oxalica/rust-overlay";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -14,6 +15,7 @@
 
   outputs = {
     self,
+    crane,
     nixpkgs,
     flake-utils,
     rust-overlay,
@@ -26,12 +28,45 @@
         (import rust-overlay)
       ];
     };
+
+    lib = pkgs.lib;
+
+    rustup = rec {
+      toolchain = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
+      craneLib = (crane.mkLib pkgs).overrideToolchain toolchain;
+      commonArgs = mkCommonArgs craneLib;
+    };
+
+    rustupDevShell = rec {
+      toolchain = rustup.toolchain.override (prev: {
+        extensions = prev.extensions ++ ["rust-analyzer"];
+      });
+      craneLib = (crane.mkLib pkgs).overrideToolchain toolchain;
+      commonArgs = mkCommonArgs craneLib;
+    };
+
+    basicArgs = {
+      src = pkgs;
+      pname = "Radicle Desktop";
+      strictDeps = true;
+    };
+
+    # Common arguments can be set here to avoid repeating them later
+    mkCommonArgs = craneLib:
+      basicArgs
+      // {
+        cargoArtifacts = craneLib.buildDepsOnly basicArgs;
+
+        buildInputs = lib.optionals pkgs.stdenv.buildPlatform.isDarwin (with pkgs; [
+          darwin.apple_sdk.frameworks.Security
+        ]);
+      };
   in {
     checks = {
       radicle-desktop = self.packages.${system}.radicle-desktop.overrideAttrs {doCheck = true;};
     };
 
-    devShells.default = pkgs.mkShell {
+    devShells.default = rustupDevShell.craneLib.devShell {
       name = "radicle-desktop-env";
       inputsFrom = [self.checks.${system}.radicle-desktop];
       nativeBuildInputs = with pkgs; [