diff --git a/npins/default.nix b/npins/default.nix
new file mode 100644
index 00000000..d256a275
--- /dev/null
+++ b/npins/default.nix
@@ -0,0 +1,81 @@
+# Generated by npins. Do not modify; will be overwritten regularly
+let
+  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  version = data.version;
+
+  mkSource =
+    spec:
+    assert spec ? type;
+    let
+      path =
+        if spec.type == "Git" then
+          mkGitSource spec
+        else if spec.type == "GitRelease" then
+          mkGitSource spec
+        else if spec.type == "PyPi" then
+          mkPyPiSource spec
+        else if spec.type == "Channel" then
+          mkChannelSource spec
+        else
+          builtins.throw "Unknown source type ${spec.type}";
+    in
+    spec // { outPath = path; };
+
+  mkGitSource =
+    {
+      repository,
+      revision,
+      url ? null,
+      hash,
+      branch ? null,
+      ...
+    }:
+    assert repository ? type;
+    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
+    # In the latter case, there we will always be an url to the tarball
+    if url != null then
+      (builtins.fetchTarball {
+        inherit url;
+        sha256 = hash; # FIXME: check nix version & use SRI hashes
+      })
+    else
+      assert repository.type == "Git";
+      let
+        urlToName =
+          url: rev:
+          let
+            matched = builtins.match "^.*/([^/]*)(\\.git)?$" repository.url;
+
+            short = builtins.substring 0 7 rev;
+
+            appendShort = if (builtins.match "[a-f0-9]*" rev) != null then "-${short}" else "";
+          in
+          "${if matched == null then "source" else builtins.head matched}${appendShort}";
+        name = urlToName repository.url revision;
+      in
+      builtins.fetchGit {
+        url = repository.url;
+        rev = revision;
+        inherit name;
+        allRefs = true;
+        # hash = hash;
+      };
+
+  mkPyPiSource =
+    { url, hash, ... }:
+    builtins.fetchurl {
+      inherit url;
+      sha256 = hash;
+    };
+
+  mkChannelSource =
+    { url, hash, ... }:
+    builtins.fetchTarball {
+      inherit url;
+      sha256 = hash;
+    };
+in
+if version == 3 then
+  builtins.mapAttrs (_: mkSource) data.pins
+else
+  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
diff --git a/npins/sources.json b/npins/sources.json
new file mode 100644
index 00000000..9ed77931
--- /dev/null
+++ b/npins/sources.json
@@ -0,0 +1,33 @@
+{
+  "pins": {
+    "kat-pkgs": {
+      "type": "Git",
+      "repository": {
+        "type": "Git",
+        "url": "https://git.dgnum.eu/lbailly/kat-pkgs.git"
+      },
+      "branch": "master",
+      "revision": "6b600b716f409c6012b424de006eac3b02148b81",
+      "url": null,
+      "hash": "0204f91vxa5qglihpfkf3j5w3k7v98wry861xf2skl024faf9idf"
+    },
+    "nix-pkgs": {
+      "type": "Git",
+      "repository": {
+        "type": "Git",
+        "url": "https://git.hubrecht.ovh/hubrecht/nix-pkgs"
+      },
+      "branch": "main",
+      "revision": "ac4ff5a34789ae3398aff9501735b67b6a5a285a",
+      "url": null,
+      "hash": "16n37f74p6h30hhid98vab9w5b08xqj4qcshz2kc1jh67z5n49p6"
+    },
+    "nixpkgs": {
+      "type": "Channel",
+      "name": "nixos-unstable",
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-25.05beta719504.a73246e2eef4/nixexprs.tar.xz",
+      "hash": "1jjmg13jzbqxm5m5ql51n2kq1qggfyb0rhmjwhqhvqxhl350z58a"
+    }
+  },
+  "version": 3
+}
\ No newline at end of file
diff --git a/shell.nix b/shell.nix
index 69411b79..ee150476 100644
--- a/shell.nix
+++ b/shell.nix
@@ -1,30 +1,57 @@
-{
-  pkgs ? import <nixpkgs> { },
-  ...
-}:
-
 let
-  python = pkgs.python39;
+  sources = import ./npins;
+  pkgs = import sources.nixpkgs { };
+  nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
+  kat-pkgs = import sources.kat-pkgs { inherit pkgs; };
+  python3 = pkgs.python3.override {
+    packageOverrides = final: prev: {
+      inherit (nix-pkgs) authens django-bootstrap-form django-cas-ng;
+      inherit (kat-pkgs.python3Packages)
+        django-djconfig
+        django-hCaptcha
+        wagtail-modeltranslation
+        wagtailmenus
+        ;
+    };
+  };
 in
-
 pkgs.mkShell {
   shellHook = ''
     export DJANGO_SETTINGS_MODULE=gestioasso.settings.local
-
-    virtualenv .venv
-    source .venv/bin/activate
-
-    pip install -r requirements-devel.txt | grep -v 'Requirement already satisfied:'
   '';
 
-  packages =
-    [ python ]
-    ++ (with python.pkgs; [
-      django-types
-      pip
-      virtualenv
-      python-ldap
-    ]);
+  packages = [
+    (python3.withPackages (
+      ps: with ps; [
+        django
+        pillow
+        authens
+        channels
+        configparser
+        django-autocomplete-light
+        django-bootstrap-form
+        django-cas-ng
+        django-cors-headers
+        django-djconfig
+        django-hCaptcha
+        django-js-reverse
+        django-widget-tweaks
+        icalendar
+        python-dateutil
+        statistics
+        wagtail-modeltranslation
+        wagtail
+        wagtailmenus
+
+        django-debug-toolbar
+        ipython
+        black
+        flake8
+        isort
+      ]
+    ))
+    pkgs.npins
+  ];
 
   allowSubstitutes = false;
 }