diff --git a/AGENTS.md b/AGENTS.md
index f967938..30b2542 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -30,7 +30,11 @@ the project version, or pass your own at configure time:
 cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION="1.2.3"
 ```
 
-The Nix package passes its flake version automatically via `cmakeFlags`.
+The Nix package bakes `-DAPP_VERSION=<pkg version>` via `cmakeFlags` (version is
+hardcoded `0.1.0` in `nix/package.nix`, not read from the flake). `nix develop`
+sets `APP_VERSION=dev` and exports `API_KEY` from the ambient environment
+(falling back to `RWT_LIVE_API_KEY`). CMake seeds a *fresh* configure from the
+`APP_VERSION` / `API_KEY` env vars; `-D` wins on reconfigure.
 
 The portal API key is also a build-time argument: `-DAPI_KEY="..."` (CMake) or
 `apiKey` on `callPackage` (Nix). It is compiled into the binary as the
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 43e057a..d6bb29f 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -8,15 +8,29 @@ set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 # App version string shown at the top of the Home footer. Defaults to the
 # project version; override at configure time with:
 #   cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION="1.2.3"
-set(APP_VERSION "${PROJECT_VERSION}" CACHE STRING
-    "Version string shown in the Home footer (override at configure time)")
+# or by exporting APP_VERSION in the environment (the `nix develop` shell does
+# this; the env var only seeds a fresh configure, -D wins on reconfigure).
+if(DEFINED ENV{APP_VERSION})
+  set(APP_VERSION "$ENV{APP_VERSION}" CACHE STRING
+      "Version string shown in the Home footer (override at configure time)")
+else()
+  set(APP_VERSION "${PROJECT_VERSION}" CACHE STRING
+      "Version string shown in the Home footer (override at configure time)")
+endif()
 
 # API bearer key baked into the binary and sent as `Authorization: Bearer <key>`
 # on every portal request. Leave empty to send no auth header. Never commit the
 # real value — inject it at CI build time from a secret, e.g.:
 #   cmake ... -DAPI_KEY="${{ secrets.PORTAL_API_KEY }}"
-set(API_KEY "" CACHE STRING
-    "Portal API key baked into the binary (leave empty to skip auth)")
+# The `nix develop` shell exports API_KEY from the ambient environment, which
+# seeds a fresh configure; -D wins on reconfigure.
+if(DEFINED ENV{API_KEY})
+  set(API_KEY "$ENV{API_KEY}" CACHE STRING
+      "Portal API key baked into the binary (leave empty to skip auth)")
+else()
+  set(API_KEY "" CACHE STRING
+      "Portal API key baked into the binary (leave empty to skip auth)")
+endif()
 
 find_package(SDL3 REQUIRED)
 find_package(SDL3_ttf REQUIRED)
@@ -31,8 +45,8 @@ include(GoogleTest)
 
 # Network manager dependencies (Linux only)
 if(UNIX AND NOT APPLE)
-    find_package(PkgConfig REQUIRED)
-    pkg_check_modules(SDBUS REQUIRED libsystemd)
+  find_package(PkgConfig REQUIRED)
+  pkg_check_modules(SDBUS REQUIRED libsystemd)
 endif()
 
 add_executable(radiantwave
@@ -92,9 +106,9 @@ target_link_libraries(radiantwave PRIVATE
 )
 
 if(UNIX AND NOT APPLE)
-    target_link_libraries(radiantwave PRIVATE ${SDBUS_LIBRARIES} resolv)
-    target_include_directories(radiantwave PRIVATE ${SDBUS_INCLUDE_DIRS})
-    target_compile_definitions(radiantwave PRIVATE HAS_DBUS=1)
+  target_link_libraries(radiantwave PRIVATE ${SDBUS_LIBRARIES} resolv)
+  target_include_directories(radiantwave PRIVATE ${SDBUS_INCLUDE_DIRS})
+  target_compile_definitions(radiantwave PRIVATE HAS_DBUS=1)
 endif()
 
 install(TARGETS radiantwave RUNTIME DESTINATION bin)
diff --git a/flake.nix b/flake.nix
index 8ec25cf..89bd638 100644
--- a/flake.nix
+++ b/flake.nix
@@ -39,8 +39,20 @@
             devShells.default = pkgs.mkShell {
               inputsFrom = [ self.packages.${system}.default ];
               packages = [ ];
+              env = {
+                # APP_VERSION and API_KEY are CMake cache variables with no
+                # default; on a fresh configure cmake seeds their cache from
+                # environment variables of the same name, so a plain
+                # `cmake -S . -B build` bakes them into the binary.
+                APP_VERSION = "dev";
+              };
               shellHook = ''
-                echo "RadiantWave dev shell"
+                # Never commit the real key. Export API_KEY (or the CI name
+                # RWT_LIVE_API_KEY) in your ambient environment and this shell
+                # picks it up; empty by default (no auth header).
+                export API_KEY="''${API_KEY:-''${RWT_LIVE_API_KEY:-}}"
+
+                echo "RadiantWave dev shell (APP_VERSION=dev, API_KEY=$([[ -n "$API_KEY" ]] && echo set || echo unset))"
                 echo "  Configure: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug"
                 echo "  Build:     cmake --build build"
                 echo "  Run:       ./build/radiantwave"