SFT-6061: cleaned up nix shell setup

diff --git a/flake.nix b/flake.nix
index 209a303..a8aa0e5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,4 +1,4 @@
-# SPDX-FileCopyrightText: 2025 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-FileCopyrightText: 2026 Foundation Devices, Inc. <hello@foundation.xyz>
 # SPDX-License-Identifier: GPL-3.0-or-later
 {
   description = "Passport Core development environment";
@@ -53,6 +53,7 @@
             fenix
             ;
         }
+        // import ./nix/mpy-cross.nix { inherit self pkgs; }
         // import ./nix/cosign.nix { inherit self system pkgs; }
       );
 
@@ -64,32 +65,32 @@
             config.allowUnfree = true;
           };
           customPackages = self.packages.${system};
-          runtimeLibPath = pkgs.lib.makeLibraryPath [
-            pkgs.stdenv.cc.cc.lib
-            pkgs.glib
-            pkgs.wayland
-            pkgs.libdecor
-            pkgs.libglvnd
-            pkgs.libICE
-            pkgs.libSM
-            pkgs.libx11
-            pkgs.libxau
-            pkgs.libxcb
-            pkgs.libxdmcp
-            pkgs.libxext
-            pkgs.libxkbcommon
-            pkgs.SDL2
-            pkgs.sdl3
-            pkgs.zlib
+          runtimeLibPath = with pkgs; pkgs.lib.makeLibraryPath [
+            stdenv.cc.cc.lib
+            glib
+            wayland
+            libdecor
+            libglvnd
+            libICE
+            libSM
+            libx11
+            libxau
+            libxcb
+            libxdmcp
+            libxext
+            libxkbcommon
+            SDL2
+            sdl3
+            zlib
           ];
           mkShell = packages:
-            pkgs.mkShell {
+            pkgs.mkShellNoCC {
               inherit packages;
-              hardeningDisable = [ "fortify" ];
+              hardeningDisable = [ "all" ];
+              CC = "${pkgs.gcc13}/bin/gcc";
+              CXX = "${pkgs.gcc13}/bin/g++";
+              MPY_CROSS = "${customPackages.mpy-cross}/bin/mpy-cross";
               shellHook = ''
-                repo_root=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
-                export CC=${pkgs.gcc13}/bin/gcc
-                export CXX=${pkgs.gcc13}/bin/g++
                 if [ -n "''${LD_LIBRARY_PATH:-}" ]; then
                   export LD_LIBRARY_PATH=''${LD_LIBRARY_PATH}:${runtimeLibPath}
                 else
@@ -107,10 +108,6 @@
                 if [ "$(uname -s)" = "Linux" ] && [ -z "''${QT_QPA_PLATFORM:-}" ]; then
                   export QT_QPA_PLATFORM=xcb
                 fi
-                export MPY_CROSS="$repo_root/mpy-cross/mpy-cross"
-                if [ ! -x "$MPY_CROSS" ]; then
-                  make -C "$repo_root/mpy-cross"
-                fi
               '';
             };
 
@@ -139,6 +136,7 @@
             ]
             ++ [
               customPackages.cosign
+              customPackages.mpy-cross
               customPackages.rust-core
             ];
 
diff --git a/nix/mpy-cross.nix b/nix/mpy-cross.nix
new file mode 100644
index 0000000..eb19c3a
--- /dev/null
+++ b/nix/mpy-cross.nix
@@ -0,0 +1,49 @@
+{
+  self,
+  pkgs,
+  ...
+}:
+let
+  foundationRust = pkgs.rustPlatform.buildRustPackage rec {
+    pname = "passport-foundation-rust";
+    version = "0.1.0";
+    src = self + "/extmod/foundation-rust";
+    cargoLock = {
+      lockFile = src + "/Cargo.lock";
+    };
+    doCheck = false;
+    buildFeatures = [ "std" ];
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/include $out/lib
+      cp include/foundation.h $out/include/foundation.h
+      libfoundation=$(find target -type f -path "*/release/libfoundation.a" | head -n1)
+      cp "$libfoundation" $out/lib/libfoundation.a
+      runHook postInstall
+    '';
+  };
+in
+{
+  foundation-rust = foundationRust;
+  mpy-cross = pkgs.gcc13Stdenv.mkDerivation {
+    pname = "passport-mpy-cross";
+    version = "0.1.0";
+    src = self;
+    nativeBuildInputs = with pkgs; [
+      gnumake
+      python3
+    ];
+    dontConfigure = true;
+    buildPhase = ''
+      runHook preBuild
+      make -C mpy-cross FOUNDATION_RUST=${foundationRust} FOUNDATION_RUST_LIB=${foundationRust}/lib/libfoundation.a FOUNDATION_RUST_SRC=
+      runHook postBuild
+    '';
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/bin
+      cp mpy-cross/mpy-cross $out/bin/mpy-cross
+      runHook postInstall
+    '';
+  };
+}