diff --git a/zkapauthorizer.nix b/zkapauthorizer.nix
index 282bdc8036b1aee7a1792c88343220e4cf66d90c..8265f890df9f900dcdea5b87d159ae117ceaf33d 100644
--- a/zkapauthorizer.nix
+++ b/zkapauthorizer.nix
@@ -8,6 +8,8 @@ buildPythonPackage rec {
   name = "${pname}-${version}";
   src = ./.;
 
+  outputs = [ "out" "doc" ];
+
   depsBuildBuild = [
     sphinx
     circleci-cli
@@ -30,7 +32,15 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    ${pyflakes}/bin/pyflakes src/_zkapauthorizer
-    python -m coverage run --source _zkapauthorizer,twisted.plugins.zkapauthorizer --module twisted.trial _zkapauthorizer
+    runHook preCheck
+    "${pyflakes}/bin/pyflakes" src/_zkapauthorizer
+    python -m coverage run --branch --source _zkapauthorizer,twisted.plugins.zkapauthorizer --module twisted.trial _zkapauthorizer
+    runHook postCheck
+  '';
+
+  postCheck = ''
+    python -m coverage html
+    mkdir -p "$doc/share/doc/${name}"
+    cp -vr .coverage htmlcov "$doc/share/doc/${name}"
   '';
 }