diff --git a/.envrc.example b/.envrc.example
new file mode 100644
index 0000000..3550a30
--- /dev/null
+++ b/.envrc.example
@@ -0,0 +1 @@
+use flake
diff --git a/.gitignore b/.gitignore
index 7cf5941..c08c1df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,7 @@
 edge-connect
 # Added by goreleaser init:
 dist/
+
+### direnv ###
+.direnv
+.envrc
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..eb9d74d
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,25 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1759733170,
+        "narHash": "sha256-TXnlsVb5Z8HXZ6mZoeOAIwxmvGHp1g4Dw89eLvIwKVI=",
+        "rev": "8913c168d1c56dc49a7718685968f38752171c3b",
+        "revCount": 873256,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/NixOS/nixpkgs/0.1.873256%2Brev-8913c168d1c56dc49a7718685968f38752171c3b/0199bd36-8ae7-7817-b019-8688eb4f61ff/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/NixOS/nixpkgs/0.1"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..2536eb7
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,38 @@
+{
+  description = "A Nix-flake-based Go development environment";
+
+  inputs.nixpkgs.url = "https://flakehub.com/f/NixOS/nixpkgs/0.1";
+
+  outputs = inputs:
+    let
+      goVersion = 25; # Change this to update the whole stack
+
+      supportedSystems = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
+      forEachSupportedSystem = f: inputs.nixpkgs.lib.genAttrs supportedSystems (system: f {
+        pkgs = import inputs.nixpkgs {
+          inherit system;
+          overlays = [ inputs.self.overlays.default ];
+        };
+      });
+    in
+    {
+      overlays.default = final: prev: {
+        go = final."go_1_${toString goVersion}";
+      };
+
+      devShells = forEachSupportedSystem ({ pkgs }: {
+        default = pkgs.mkShell {
+          packages = with pkgs; [
+            # go (version is specified by overlay)
+            go
+
+            # goimports, godoc, etc.
+            gotools
+
+            # https://github.com/golangci/golangci-lint
+            golangci-lint
+          ];
+        };
+      });
+    };
+}
diff --git a/internal/apply/planner.go b/internal/apply/planner.go
index a9219ea..4e2a3e0 100644
--- a/internal/apply/planner.go
+++ b/internal/apply/planner.go
@@ -391,8 +391,13 @@ func (p *EdgeConnectPlanner) compareAppStates(current, desired *AppState) ([]str
 	// Compare outbound connections
 	outboundChanges := p.compareOutboundConnections(current.OutboundConnections, desired.OutboundConnections)
 	if len(outboundChanges) > 0 {
-		changes = append(changes, "Outbound connections changed:")
-		changes = append(changes, outboundChanges...)
+		sb:= strings.Builder{}
+		sb.WriteString("Outbound connections changed:\n")
+		for _, change := range outboundChanges {
+			sb.WriteString(change)
+			sb.WriteString("\n")
+		}
+		changes = append(changes, sb.String())
 	}
 
 	return changes, manifestChanged
diff --git a/internal/apply/planner_test.go b/internal/apply/planner_test.go
index cd9ef31..358ae41 100644
--- a/internal/apply/planner_test.go
+++ b/internal/apply/planner_test.go
@@ -185,6 +185,7 @@ func TestPlanExistingDeploymentNoChanges(t *testing.T) {
 	// Note: We would calculate expected manifest hash here when API supports it
 
 	// Mock existing app with same manifest hash and outbound connections
+	manifestContent := "apiVersion: v1\nkind: Pod\nmetadata:\n  name: test\n"
 	existingApp := &edgeconnect.App{
 		Key: edgeconnect.AppKey{
 			Organization: "testorg",
@@ -192,6 +193,7 @@ func TestPlanExistingDeploymentNoChanges(t *testing.T) {
 			Version:      "1.0.0",
 		},
 		Deployment: "kubernetes",
+		DeploymentManifest: manifestContent,
 		RequiredOutboundConnections: []edgeconnect.SecurityRule{
 			{
 				Protocol:     "tcp",