diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index c40c7ab3..1438cbce 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -49,7 +49,8 @@ jobs:
         env:
           SKIP_HAPP_BUILD: 1 # Prevent hApp builds from running when linting
         run: |
-          nix develop --command bash -c "source ./scripts/checks.sh && check_rust_static"
+          # Currently the only check is clippy, could bundle the other checks into the flake and remove the steps above?
+          nix flake check
 
       - name: Build and unit tests
         run: |
diff --git a/nix/modules/rust.nix b/nix/modules/rust.nix
index 681dd30e..632eee9c 100644
--- a/nix/modules/rust.nix
+++ b/nix/modules/rust.nix
@@ -12,6 +12,7 @@
 
       rustWithWasmTarget = rustPkgs.rust-bin.stable."${rustVersion}".minimal.override {
         targets = [ "wasm32-unknown-unknown" ];
+        extensions = [ "clippy" ];
       };
 
       craneLib = (inputs.crane.mkLib rustPkgs).overrideToolchain rustWithWasmTarget;
diff --git a/nix/modules/workspace.nix b/nix/modules/workspace.nix
index c91f14ac..3ff54db2 100644
--- a/nix/modules/workspace.nix
+++ b/nix/modules/workspace.nix
@@ -7,30 +7,50 @@
         if system == "x86_64-darwin"
         then pkgs.openssl # pkgsStatic is considered a cross build and this is not yet supported
         else pkgs.pkgsStatic.openssl;
+
+      commonArgs = {
+        pname = "workspace";
+        version = "0.1.0";
+
+        src = craneLib.cleanCargoSource (craneLib.path ./../..);
+        strictDeps = true;
+
+        buildInputs = with pkgs; [
+          # Some Holochain crates link against openssl
+          openssl
+          opensslStatic
+        ];
+
+        nativeBuildInputs = with pkgs; [
+          # To build openssl-sys
+          perl
+          pkg-config
+          # Because the holochain_client depends on Kitsune/tx5
+          go
+        ];
+      };
+
+      cargoArtifacts = craneLib.buildDepsOnly (commonArgs // {
+        pname = "${commonArgs.pname}-deps";
+      });
+
+      workspace = craneLib.buildPackage (commonArgs // {
+        inherit cargoArtifacts;
+      });
+
+      workspaceClippy = craneLib.cargoClippy (commonArgs // {
+        inherit cargoArtifacts;
+        cargoClippyExtraArgs = "--all-targets --all-features -- --deny warnings";
+      });
     in
     {
       packages = {
-        workspace = craneLib.buildPackage {
-          pname = "workspace";
-          version = "0.1.0";
-
-          src = craneLib.cleanCargoSource (craneLib.path ./../..);
-          strictDeps = true;
-
-          buildInputs = with pkgs; [
-            # Some Holochain crates link against openssl
-            openssl
-            opensslStatic
-          ];
-
-          nativeBuildInputs = with pkgs; [
-            # To build openssl-sys
-            perl
-            pkg-config
-            # Because the holochain_client depends on Kitsune/tx5
-            go
-          ];
-        };
+        default = workspace;
+        inherit workspace;
+      };
+
+      checks = {
+        inherit workspaceClippy;
       };
     };
 }
diff --git a/scripts/checks.sh b/scripts/checks.sh
index 0fa7f6cd..b6561bad 100644
--- a/scripts/checks.sh
+++ b/scripts/checks.sh
@@ -17,7 +17,7 @@ check_rust_fmt() {
 }
 
 check_rust_static() {
-  cargo clippy --workspace --all-targets --all-features -- -D warnings
+  cargo clippy --workspace --all-targets --all-features -- --deny warnings
 }
 
 check_all() {