diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index c360292fb..680fcb457 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -16,5 +16,5 @@ jobs:
     steps:
     - uses: actions/checkout@v3
     - uses: cachix/install-nix-action@v20
-    - run: nix build
+    - run: nix build -L
     - run: nix flake check
diff --git a/MANIFEST.in b/MANIFEST.in
index d7802a952..813b9c472 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -2,5 +2,7 @@ include src/batou/insecure-private.key
 recursive-include src/batou/init-template *
 recursive-include src/batou/tests/fixture *
 recursive-include src/batou/lib/resources *
+recursive-include src/batou/lib/tests *
+recursive-include src/batou/secrets/tests/fixture *
 global-include *.txt
 global-include *.in
diff --git a/flake.nix b/flake.nix
index 0e0cf4bc8..92c5b13bb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -56,7 +56,28 @@
 
         devShells.default = pkgs.mkShell {
           packages = [
-            (pkgs.python3.withPackages (ps: [batou ps.tox]))
+            #(pkgs.python3.withPackages (ps: [ps.tox ps.setuptools ps.pytest]))
+            (pkgs.python3.withPackages (ps: [
+              ps.mock
+              ps.pytest
+              ps.pytest-cov
+              ps.pytest-instafail
+              ps.pytest-timeout
+
+              ps.requests
+              ps.pyyaml
+              ps.execnet
+              ps.importlib-metadata
+              ps.importlib-resources
+              ps.remote-pdb
+              ps.py
+              ps.configupdater
+              ps.setuptools
+              ps.jinja2
+            ]))
+            pkgs.mercurial
+            pkgs.age
+            pkgs.subversion
           ];
 
           shellHook = ''
diff --git a/nix/batou.nix b/nix/batou.nix
index 09fb7568a..1c3c3716a 100644
--- a/nix/batou.nix
+++ b/nix/batou.nix
@@ -1,7 +1,12 @@
 {
+  gnupg,
+  rsync,
+  unzip,
+  git,
+  subversion,
+  age,
+  mercurial,
   buildPythonPackage,
-  fetchPypi,
-  markupsafe,
   requests,
   pyyaml,
   execnet,
@@ -10,29 +15,84 @@
   remote-pdb,
   py,
   configupdater,
-  mock,
-  pytest,
   setuptools,
   jinja2,
   src,
+  pytestCheckHook,
+  mock,
+  pytest-cov,
+  pytest-instafail,
+  pytest-timeout,
+  python,
 }:
-  buildPythonPackage {
-    propagatedBuildInputs = [
-      requests
-      pyyaml
-      execnet
-      importlib-metadata
-      importlib-resources
-      remote-pdb
-      py
-      configupdater
-      mock
-      pytest
-      setuptools
-      jinja2
-    ];
-
-    pname = "batou";
-    version = "latest";
-    inherit src;
-  }
+buildPythonPackage {
+  build-system = [setuptools];
+  dependencies = [
+    configupdater
+    execnet
+    importlib-metadata
+    importlib-resources
+    jinja2
+    py
+    pyyaml
+    remote-pdb
+    requests
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+
+    mock
+    py
+    pytest-cov
+    pytest-instafail
+    pytest-timeout
+    requests
+
+    age
+    git
+    gnupg
+    mercurial
+    rsync
+    subversion
+    unzip
+  ];
+
+  PY_IGNORE_IMPORTMISMATCH = 1;
+
+  preCheck = ''
+    export PYTHONPATH=${py}/${python.sitePackages}:$PYTHONPATH
+  '';
+
+  disabledTests = [
+    # requires internet access
+    "test_manage__2_age"
+    "test_manage__reencrypt__1"
+
+    # requires access to /usr/bin/hdiutil
+    "test_dmg_extracts_archive_to_target_directory"
+
+    # cannot resolve hosts in sandbox
+    "test_address_netloc_attributes"
+    "test_address_resolves_listen_address"
+
+    # does not return relative but absolute paths
+    # can probably be fixed, then reenabled
+    "test_edit_command_loop"
+  ];
+
+  disabledTestPaths = [
+    # requires internet access for download / pip install
+    "src/batou/lib/tests/test_appenv.py"
+    "src/batou/lib/tests/test_buildout.py"
+    "src/batou/lib/tests/test_download.py"
+    "src/batou/lib/tests/test_supervisor.py"
+
+    # bad interpreter `/usr/bin/env python3` in appenv.py
+    "src/batou/tests/test_endtoend.py"
+  ];
+
+  pname = "batou";
+  version = "latest";
+  inherit src;
+}
diff --git a/src/batou/secrets/tests/fixture/gnupg/S.gpg-agent b/src/batou/secrets/tests/fixture/gnupg/S.gpg-agent
new file mode 100644
index 000000000..63837678b
--- /dev/null
+++ b/src/batou/secrets/tests/fixture/gnupg/S.gpg-agent
@@ -0,0 +1,2 @@
+%Assuan%
+socket=/tmp/S.gpg-agent-batou
diff --git a/src/batou/secrets/tests/fixture/gnupg/S.gpg-agent.ssh b/src/batou/secrets/tests/fixture/gnupg/S.gpg-agent.ssh
new file mode 100644
index 000000000..6e28ed81f
--- /dev/null
+++ b/src/batou/secrets/tests/fixture/gnupg/S.gpg-agent.ssh
@@ -0,0 +1,2 @@
+%Assuan%
+socket=/tmp/S.gpg-agent-batou.ssh
diff --git a/src/batou/secrets/tests/fixture/gnupg/gpg-agent.conf b/src/batou/secrets/tests/fixture/gnupg/gpg-agent.conf
new file mode 100644
index 000000000..5c1feb980
--- /dev/null
+++ b/src/batou/secrets/tests/fixture/gnupg/gpg-agent.conf
@@ -0,0 +1,2 @@
+extra-socket /tmp/S.gpg-agent-batou.extra
+browser-socket /tmp/S.gpg-agent-batou.browser