diff --git a/.gitignore b/.gitignore
index c8a3547..74e8743 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,6 @@ site/content/*/*
 
 # Translation status file created by check_translations.py
 site/i18n/.status
+
+# nix shell created Drone token file
+drone_token.txt
diff --git a/Dockerfile b/Dockerfile
index 12dfdd1..fb9eace 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,10 +24,10 @@ RUN sed -i \
 # Development Preparation: run po4a and hugo
 # =============================================================================
 
-FROM alpine AS dev-prep
+FROM git.fsfe.org/fsfe-system-hackers/hugo-container:0.152.0 AS dev-prep
 
 # Dependencies
-RUN apk --no-cache add bash perl-yaml-tiny po4a hugo python3 diffutils
+RUN apk --no-cache add bash perl-yaml-tiny po4a python3 diffutils
 
 COPY . /app
 
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index bdf41dd..2dc9d21 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -2,6 +2,10 @@
 #
 # SPDX-License-Identifier: GPL-3.0-or-later
 
+# =============================================================================
+# sync docs, translate, and build hugo in Docker container
+# =============================================================================
+
 services:
   reuse-web:
     container_name: reuse-web
diff --git a/shell.nix b/shell.nix
new file mode 100644
index 0000000..939546d
--- /dev/null
+++ b/shell.nix
@@ -0,0 +1,33 @@
+# SPDX-FileCopyrightText: 2025 Free Software Foundation Europe <https://fsfe.org>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+{ pkgs ? import <nixpkgs> {} }:
+
+pkgs.mkShell {
+  # we assume the repo is cloned so git is available
+  # we assume awk is present
+  buildInputs = with pkgs; [
+    drone-cli # signing
+  ];
+  shellHook = ''
+  # DRONE
+  export DRONE_SERVER=https://drone.fsfe.org
+  export DRONE_TOKEN
+
+  DRONE_FILE=drone_token.txt
+  if [[ -r $DRONE_FILE ]]; then
+     DRONE_TOKEN=$(cat $DRONE_FILE)
+  else
+     echo "Insert your drone token (found at $DRONE_SERVER/account)"
+     read -r -p "Token: " DRONE_TOKEN
+     echo -n $DRONE_TOKEN > $DRONE_FILE
+  fi
+  unset DRONE_FILE
+
+  REPO_NAME="$(git remote get-url origin | awk -F "[:.]" '{printf $4}')"
+  alias save="drone sign --save $REPO_NAME && printf 'Hash saved!' && git add .drone.yml"
+
+  echo "You are working on $REPO_NAME repository."
+  echo "Use the \"save\" alias to drone sign and git commit your drone.yml changes."
+  '';
+}