diff --git a/nixos/release.nix b/nixos/release.nix
index ae70b535a5e..8151d1bac5e 100644
--- a/nixos/release.nix
+++ b/nixos/release.nix
@@ -284,6 +284,7 @@ in rec {
   tests.env = callTest tests/env.nix {};
   tests.ferm = callTest tests/ferm.nix {};
   tests.firefox = callTest tests/firefox.nix {};
+  tests.flatpak = callTest tests/flatpak.nix {};
   tests.firewall = callTest tests/firewall.nix {};
   tests.fwupd = callTest tests/fwupd.nix {};
   #tests.gitlab = callTest tests/gitlab.nix {};
diff --git a/nixos/tests/flatpak.nix b/nixos/tests/flatpak.nix
new file mode 100644
index 00000000000..d1c7cf84314
--- /dev/null
+++ b/nixos/tests/flatpak.nix
@@ -0,0 +1,23 @@
+# run installed tests
+import ./make-test.nix ({ pkgs, ... }:
+
+{
+  name = "flatpak";
+  meta = {
+    maintainers = pkgs.flatpak.meta.maintainers;
+  };
+
+  machine = { config, pkgs, ... }: {
+    imports = [ ./common/x11.nix ];
+    services.xserver.desktopManager.gnome3.enable = true; # TODO: figure out minimal environment where the tests work
+    services.flatpak.enable = true;
+    environment.systemPackages = with pkgs; [ gnupg gnome-desktop-testing ostree python2 ];
+    virtualisation.memorySize = 2047;
+    virtualisation.diskSize = 1024;
+  };
+
+  testScript = ''
+    $machine->waitForX();
+    $machine->succeed("gnome-desktop-testing-runner -d '${pkgs.flatpak.installedTests}/share' --timeout 3600");
+  '';
+})
diff --git a/pkgs/development/libraries/flatpak/fix-test-paths.patch b/pkgs/development/libraries/flatpak/fix-test-paths.patch
index e0734009420..a548f388286 100644
--- a/pkgs/development/libraries/flatpak/fix-test-paths.patch
+++ b/pkgs/development/libraries/flatpak/fix-test-paths.patch
@@ -33,6 +33,81 @@
      gpg-connect-agent --homedir "${FL_GPG_HOMEDIR}" killagent /bye || true
      fusermount -u $XDG_RUNTIME_DIR/doc || :
      if test -n "${TEST_SKIP_CLEANUP:-}"; then
+--- a/tests/make-test-runtime.sh
++++ b/tests/make-test-runtime.sh
+@@ -21,6 +21,7 @@
+ cat ${DIR}/metadata
+ 
+ # Add bash and dependencies
++mkdir -p ${DIR}/nix/store
+ mkdir -p ${DIR}/usr/bin
+ mkdir -p ${DIR}/usr/lib
+ ln -s ../lib ${DIR}/usr/lib64
+@@ -30,47 +31,27 @@
+ else
+     cp `which ldconfig` ${DIR}/usr/bin
+ fi
+-T=`mktemp`
+-for i in $@; do
+-    I=`which $i`
+-    cp $I ${DIR}/usr/bin
+-    ldd $I | sed "s/.* => //"  | awk '{ print $1}' | grep ^/ | grep ^/ >> $T
+-    if test $i == python2; then
+-        mkdir -p ${DIR}/usr/lib/python2.7/lib-dynload
+-        # This is a hardcoded minimal set of modules we need in the current tests.
+-        # Pretty hacky stuff. Add modules as needed.
+-        PYDIR=/usr/lib/python2.7
+-        if test -d /usr/lib64/python2.7; then PYDIR=/usr/lib64/python2.7; fi
+-        for py in site os stat posixpath genericpath warnings \
+-                       linecache types UserDict abc _abcoll \
+-                       _weakrefset copy_reg traceback sysconfig \
+-                       re sre_compile sre_parse sre_constants \
+-                       _sysconfigdata ; do
+-            cp ${PYDIR}/$py.py ${DIR}/usr/lib/python2.7
+-        done
+-        # These might not exist, depending how Python was configured; and the
+-        # part after ${so} might be "module" or ".x86_64-linux-gnu" or
+-        # something else
+-        for so in _locale strop ; do
+-            cp ${PYDIR}/lib-dynload/${so}*.so ${DIR}/usr/lib/python2.7/lib-dynload || :
+-        done
+-        for plat in $( cd ${PYDIR} && echo plat-* ); do
+-            test -e ${PYDIR}/${plat} || continue
+-            mkdir -p ${DIR}/usr/lib/python2.7/${plat}
+-            cp ${PYDIR}/${plat}/*.py ${DIR}/usr/lib/python2.7/${plat}/
+-        done
+-    fi
+-done
+ ln -s bash ${DIR}/usr/bin/sh
+-for i in `sort -u $T`; do
+-    cp "$i" ${DIR}/usr/lib/
++for i in $@; do
++    I=$(readlink -f $(which $i))
++    requisites=$(nix-store --query --requisites "$I")
++    for r in $requisites; do
++        # a single store item can be needed by multiple paths, no need to copy it again
++        if [ ! -e ${DIR}/$r ]; then
++            cp -r $r ${DIR}/$r
++        fi
++    done
++    ln -s $I ${DIR}/usr/bin/$i
+ done
+ 
+-# We copy the C.UTF8 locale and call it en_US. Its a bit of a lie, but
+-# the real en_US locale is often not available, because its in the
+-# local archive.
++mv ${DIR}/nix/store ${DIR}/usr/store # files outside /usr are not permitted, we will have to replace /nix/store with /usr/store
++chmod -R u+w ${DIR} # nix store has read-only directories which would cause problems during clean-up, files need to be writable for sed
++find ${DIR} -type f -print0 | xargs -0 sed -i 's~/nix/store/~/usr/store/~g' # replace hardcoded paths
++find ${DIR} -type l | xargs -I '{}' sh -c 'tg="$(readlink "$1")"; newtg="${tg#/nix/store/}"; if [ "$tg" != "$newtg" ]; then ln -fs "/usr/store/$newtg" "$1"; fi' -- '{}' # replace symlink targets
++
++# We copy the whole locale archive because we do not have C.UTF8 locale
+ mkdir -p ${DIR}/usr/lib/locale/
+-cp -r /usr/lib/locale/C.* ${DIR}/usr/lib/locale/en_US
++cp @glibcLocales@/lib/locale/locale-archive ${DIR}/usr/lib/locale/locale-archive
+ 
+ if [ x$COLLECTION_ID != x ]; then
+     collection_args=--collection-id=${COLLECTION_ID}
 --- a/tests/testlibrary.c
 +++ b/tests/testlibrary.c
 @@ -378,7 +378,7 @@
@@ -44,3 +119,14 @@
        g_autofree char *argv_str = g_strjoinv (" ", argv);
        g_test_message ("Spawning %s", argv_str);
        g_spawn_sync (NULL, argv, NULL, G_SPAWN_SEARCH_PATH, NULL, NULL, NULL, NULL, &exit_code, &error);
+--- a/triggers/gtk-icon-cache.trigger
++++ b/triggers/gtk-icon-cache.trigger
+@@ -1,7 +1,7 @@
+ #!/bin/sh
+ 
+ if test \( -x "$(which gtk-update-icon-cache 2>/dev/null)" \) -a \( -d $1/exports/share/icons/hicolor \); then
+-    cp /usr/share/icons/hicolor/index.theme $1/exports/share/icons/hicolor/
++    cp @hicolorIconTheme@/share/icons/hicolor/index.theme $1/exports/share/icons/hicolor/
+     for dir in $1/exports/share/icons/*; do
+         if test -f $dir/index.theme; then
+             if ! gtk-update-icon-cache --quiet $dir; then