diff --git a/default.nix b/default.nix
index 24ea4001414a9e065085ecadf725ca8417b72e90..2527bcab2bc5db49b3b2106ec314e745ba9fdd74 100644
--- a/default.nix
+++ b/default.nix
@@ -8,6 +8,7 @@ in
 }:
   let
     lib = pkgs.lib;
+    python = "python27";
     providers = {
       _default = "sdist,nixpkgs,wheel";
       # mach-nix doesn't provide a good way to depend on mach-nix packages,
@@ -29,47 +30,59 @@ in
       # - Incorrectly merged extras - https://github.com/DavHau/mach-nix/pull/334
       tqdm = "wheel";
     };
-    tahoe-lafs = mach-nix.buildPythonPackage rec {
-      python = "python27";
-      name = "tahoe-lafs";
-      version = "1.16.post999";
-      inherit providers;
-      # See https://github.com/DavHau/mach-nix/issues/190
-      requirementsExtra = ''
-        pyrsistent < 0.17
-        foolscap == 0.13.1
-        configparser
-        eliot
+  in
+    rec {
+      tahoe-lafs = mach-nix.buildPythonPackage rec {
+        inherit python providers;
+        name = "tahoe-lafs";
+        version = "1.16.post999";
+        # See https://github.com/DavHau/mach-nix/issues/190
+        requirementsExtra = ''
+          pyrsistent < 0.17
+          foolscap == 0.13.1
+          configparser
+          eliot
         '';
-      postPatch = ''
-        cat > src/allmydata/_version.py <<EOF
-        # This _version.py is generated by nix.
+        postPatch = ''
+          cat > src/allmydata/_version.py <<EOF
+          # This _version.py is generated by nix.
 
-        verstr = "${version}+git-${tahoe-lafs-repo.rev}"
-        __version__ = verstr
-        EOF
-      '';
-      src = tahoe-lafs-repo;
-    };
-  in
-    mach-nix.buildPythonApplication rec {
-      python = "python27";
-      src = ./.;
-      inherit providers;
-      # mach-nix does not provide a way to specify dependencies on other
-      # mach-nix packages, that incorporates the requirements and overlays
-      # of that package.
-      # See https://github.com/DavHau/mach-nix/issues/123
-      # In particular, we explicitly include the requirements of tahoe-lafs
-      # here, and include it in a python package overlay.
-      requirementsExtra = tahoe-lafs.requirements;
-      overridesPre = [
-        (
-          self: super: {
-            inherit tahoe-lafs;
-          }
-        )
-      ];
-      # Record some settings here, so downstream nix files can consume them.
-      meta.mach-nix = { inherit python providers; };
+          verstr = "${version}+git-${tahoe-lafs-repo.rev}"
+          __version__ = verstr
+          EOF
+        '';
+        src = tahoe-lafs-repo;
+      };
+      zkapauthorizer = mach-nix.buildPythonApplication rec {
+        inherit python providers;
+        src = ./.;
+        # mach-nix does not provide a way to specify dependencies on other
+        # mach-nix packages, that incorporates the requirements and overlays
+        # of that package.
+        # See https://github.com/DavHau/mach-nix/issues/123
+        # In particular, we explicitly include the requirements of tahoe-lafs
+        # here, and include it in a python package overlay.
+        requirementsExtra = tahoe-lafs.requirements;
+        overridesPre = [
+          (
+            self: super: {
+              inherit tahoe-lafs;
+            }
+          )
+        ];
+        # Record some settings here, so downstream nix files can consume them.
+        meta.mach-nix = { inherit python providers; };
+      };
+
+      privatestorage = let
+        python-env = mach-nix.mkPython {
+          inherit python providers;
+          packagesExtra = [ zkapauthorizer tahoe-lafs ];
+        };
+      in
+        pkgs.runCommandNoCC "privatestorage" {}
+          ''
+            mkdir -p $out/bin
+            ln -s ${python-env}/bin/tahoe $out/bin
+          '';
     }
diff --git a/tests.nix b/tests.nix
index f617608d48de24a620c0d50198f1dcd4eac0b7b2..727e4e2508c476787254d3d8dc4f11bbcb4d89da 100644
--- a/tests.nix
+++ b/tests.nix
@@ -4,7 +4,7 @@ in
 { pkgs ? import sources.release2015 {}
 , pypiData ? sources.pypi-deps-db
 , mach-nix ? import sources.mach-nix { inherit pkgs pypiData; }
-, zkapauthorizer ? import ./. { inherit pkgs pypiData mach-nix; }
+, zkapauthorizer ? (import ./. { inherit pkgs pypiData mach-nix; }).zkapauthorizer
 , ci-reports ? false
 , hypothesisProfile ? null
 , collectCoverage ? false