diff --git a/default.nix b/default.nix
index fed95addc8..ebd53b56f5 100644
--- a/default.nix
+++ b/default.nix
@@ -13,6 +13,7 @@ in fix (self:
 
     third_party = import ./third_party ch;
     ops = import ./ops ch;
+    nix = import ./nix ch;
 
     lib = self.third_party.nixpkgs.lib;
   })
diff --git a/nix/default.nix b/nix/default.nix
new file mode 100644
index 0000000000..6aca2df9b4
--- /dev/null
+++ b/nix/default.nix
@@ -0,0 +1,3 @@
+args: {
+  pkgs = import ./pkgs args;
+}
diff --git a/nix/pkgs/default.nix b/nix/pkgs/default.nix
new file mode 100644
index 0000000000..8f1c07d039
--- /dev/null
+++ b/nix/pkgs/default.nix
@@ -0,0 +1,3 @@
+args: {
+  javaws-env = import ./javaws-env.nix args;
+}
diff --git a/nix/pkgs/javaws-env.nix b/nix/pkgs/javaws-env.nix
new file mode 100644
index 0000000000..b309406c1c
--- /dev/null
+++ b/nix/pkgs/javaws-env.nix
@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+pkgs.buildFHSUserEnv {
+  name = "javaws-env";
+  targetPkgs = pkgs: (with pkgs;
+    [
+      adoptopenjdk-icedtea-web
+    ]);
+  runScript = "javaws";
+}
diff --git a/ops/nixos/porcorosso/default.nix b/ops/nixos/porcorosso/default.nix
index 426d1182da..e76e2ed900 100644
--- a/ops/nixos/porcorosso/default.nix
+++ b/ops/nixos/porcorosso/default.nix
@@ -185,6 +185,12 @@ in {
       uid = 1000;
       extraGroups = [ "wheel" "networkmanager" ];
       hashedPassword = secrets.passwordHashes.root;
+      packages = [
+        (pkgs.writeScriptBin "javaws" ''
+          #!/bin/sh
+          exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
+        '')
+      ];
     };
   };