diff --git a/lib/nixpkgs-settings.nix b/lib/nixpkgs-settings.nix
index 2d7fa2d9..30fdeaba 100644
--- a/lib/nixpkgs-settings.nix
+++ b/lib/nixpkgs-settings.nix
@@ -10,6 +10,7 @@
     };
     overlays = [
       (final: prev: {
+        dnclient = prev.callPackage ../pkgs/dnclient { };
         nixdiff = prev.callPackage ../pkgs/nixdiff { };
       })
     ];
diff --git a/modules/genebean/nixos/default.nix b/modules/genebean/nixos/default.nix
index 737cd390..fc943cde 100644
--- a/modules/genebean/nixos/default.nix
+++ b/modules/genebean/nixos/default.nix
@@ -12,6 +12,7 @@
     ./programs/thunderbird.nix
     ./programs/xfce4-terminal.nix
     ./services/chromium-kiosk.nix
+    ./services/dnclient.nix
     ./services/flatpak.nix
     ./services/kiosk-backups.nix
     ./services/restic.nix
diff --git a/modules/genebean/nixos/services/dnclient.nix b/modules/genebean/nixos/services/dnclient.nix
new file mode 100644
index 00000000..022c6d95
--- /dev/null
+++ b/modules/genebean/nixos/services/dnclient.nix
@@ -0,0 +1,31 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.genebean.services.dnclient;
+in
+{
+  options.genebean.services.dnclient = {
+    enable = lib.mkEnableOption "dnclient managed Nebula VPN";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.dnclient ];
+
+    systemd.services.dnclient = {
+      description = "DNClient Nebula VPN";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.dnclient}/bin/dnclient run";
+        Restart = "always";
+        RestartSec = "5s";
+      };
+    };
+  };
+}
diff --git a/modules/hosts/nixos/nixnuc/default.nix b/modules/hosts/nixos/nixnuc/default.nix
index e9d94f30..ca6797a5 100644
--- a/modules/hosts/nixos/nixnuc/default.nix
+++ b/modules/hosts/nixos/nixnuc/default.nix
@@ -114,6 +114,8 @@ in
     mtr.enable = true;
   };
 
+  genebean.services.dnclient.enable = true;
+
   # List services that you want to enable:
   services = {
     atuin = {
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 0d823f30..686ed59c 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -1,10 +1,16 @@
 { inputs, pkgs }:
 let
   deploy-with-retry = pkgs.callPackage ./deploy-with-retry { inherit inputs; };
+  dnclient = pkgs.callPackage ./dnclient { };
   nixdiff = pkgs.callPackage ./nixdiff { };
   rpi4-installer = pkgs.callPackage ./rpi4-installer { inherit inputs; };
 in
 {
-  inherit deploy-with-retry nixdiff rpi4-installer;
+  inherit
+    deploy-with-retry
+    dnclient
+    nixdiff
+    rpi4-installer
+    ;
   default = nixdiff;
 }
diff --git a/pkgs/dnclient/default.nix b/pkgs/dnclient/default.nix
new file mode 100644
index 00000000..06dbfd8f
--- /dev/null
+++ b/pkgs/dnclient/default.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+let
+  version = "0.9.6";
+in
+stdenv.mkDerivation {
+  pname = "dnclient";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://dl.defined.net/10c23c2d/v${version}/linux/amd64/dnclient";
+    hash = "sha256-Z/uvC89Dt8r5crkahkUhrCnSj7Ae8N54B5TZvgchtPA=";
+  };
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  installPhase = ''
+    install -Dm755 $src $out/bin/dnclient
+  '';
+
+  meta = {
+    description = "Managed Nebula VPN client from Defined Networking";
+    homepage = "https://defined.net";
+    platforms = [ "x86_64-linux" ];
+    license = lib.licenses.unfree;
+    mainProgram = "dnclient";
+  };
+}