diff --git a/.circleci/config.yml b/.circleci/config.yml
index 3fe7c7630832fb9e47fb8a214723f72827f9b9e2..b8beebcf5384813dae59fd7d8c070389e4fcd23e 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -49,30 +49,25 @@ jobs:
 
   tests:
     docker:
-      - image: "circleci/python:2.7"
+      # Run in a highly Nix-capable environment.
+      - image: "nixorg/nix:circleci"
 
     environment:
-      PIP_REQUIREMENTS: "-r requirements.txt -r requirements-tests.txt"
-      ZKAPAUTHORIZER_HYPOTHESIS_PROFILE: "ci"
+      CODECOV_TOKEN: "cc6e4697-4337-4506-88af-92b8f8ca6b22"
 
     steps:
       - "checkout"
 
-      - <<: *PREPARE_VIRTUALENV
-
       - run:
           name: "Run Test Suite"
           command: |
-            . venv/bin/activate
-            pip install .
-            coverage run -m twisted.trial _zkapauthorizer
+            nix-build --argstr hypothesisProfile ci --arg collectCoverage true --attr doc
 
       - run:
           name: "Report Coverage"
           command: |
-            . venv/bin/activate
-            CODECOV_TOKEN="cc6e4697-4337-4506-88af-92b8f8ca6b22" codecov
-
+            nix-shell -p 'python.withPackages (ps: [ ps.codecov ])' --keep CODECOV_TOKEN --run \
+              codecov ./result-doc/share/doc/*/.coverage
 
 workflows:
   version: 2
diff --git a/default.nix b/default.nix
index f1c5e37ea433eb5add61f81b6c9ed3c4b359ce25..04af35d91986bd58cdc708b9bddc31c6aa1d50d4 100644
--- a/default.nix
+++ b/default.nix
@@ -1,2 +1,2 @@
-{ pkgs ? import ./nixpkgs.nix { } }:
-pkgs.python27Packages.callPackage ./zkapauthorizer.nix { }
+{ pkgs ? import ./nixpkgs.nix { }, hypothesisProfile ? null, collectCoverage ? false }:
+pkgs.python27Packages.callPackage ./zkapauthorizer.nix { inherit hypothesisProfile collectCoverage; }
diff --git a/zkapauthorizer.nix b/zkapauthorizer.nix
index 0b311a4868fcec93729afe25b028ab4dcd336126..ae7453630fde5af7ae11afb728cdd9563f109f8c 100644
--- a/zkapauthorizer.nix
+++ b/zkapauthorizer.nix
@@ -1,6 +1,8 @@
 { buildPythonPackage, sphinx, circleci-cli
 , attrs, zope_interface, twisted, tahoe-lafs, privacypass
 , fixtures, testtools, hypothesis, pyflakes, treq, coverage
+, hypothesisProfile ? null
+, collectCoverage ? false
 }:
 buildPythonPackage rec {
   version = "0.0";
@@ -8,7 +10,7 @@ buildPythonPackage rec {
   name = "${pname}-${version}";
   src = ./.;
 
-  outputs = [ "out" "doc" ];
+  outputs = [ "out" ] ++ (if collectCoverage then [ "doc" ] else [ ]);
 
   depsBuildBuild = [
     sphinx
@@ -35,13 +37,18 @@ buildPythonPackage rec {
   checkPhase = ''
     runHook preCheck
     "${pyflakes}/bin/pyflakes" src/_zkapauthorizer
-    python -m coverage run --branch --source _zkapauthorizer,twisted.plugins.zkapauthorizer --module twisted.trial _zkapauthorizer
+    python -m ${if collectCoverage
+      then "coverage run --branch --source _zkapauthorizer,twisted.plugins.zkapauthorizer --module"
+      else ""
+    } twisted.trial _zkapauthorizer
     runHook postCheck
   '';
 
-  postCheck = ''
+  postCheck = if collectCoverage
+    then ''
     python -m coverage html
     mkdir -p "$doc/share/doc/${name}"
     cp -vr .coverage htmlcov "$doc/share/doc/${name}"
-  '';
+    ''
+    else "";
 }