diff --git a/ops/nixos/default.nix b/ops/nixos/default.nix
index de8268f7e4..617d2e6afd 100644
--- a/ops/nixos/default.nix
+++ b/ops/nixos/default.nix
@@ -17,6 +17,7 @@ let
     });
   systems = [
     "porcorosso"
+    "howl"
     "marukuru"
     "clouvider-fra01"
     "totoro"
diff --git a/ops/nixos/howl/default.nix b/ops/nixos/howl/default.nix
new file mode 100644
index 0000000000..9d286a5b3b
--- /dev/null
+++ b/ops/nixos/howl/default.nix
@@ -0,0 +1,211 @@
+# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
+#
+# SPDX-License-Identifier: Apache-2.0
+
+{ depot, lib, pkgs, rebuilder, config, ... }:
+let
+  inherit (depot.ops) secrets;
+in {
+  imports = [
+    ../lib/zfs.nix
+    ../lib/graphical-client.nix
+    ../lib/whitby-distributed.nix
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "nvme"
+    "usbhid"
+    "usb_storage"
+    "sd_mod"
+    "rtsx_pci_sdmmc"
+  ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.supportedFilesystems = [ "ntfs" ];
+  boot.kernel.sysctl = {
+    "abi.vsyscall32" = "0";
+  };
+
+  my.rundeck.expectedOnline = false;
+
+  fileSystems = let
+    zfs = device: {
+      device = device;
+      fsType = "zfs";
+    };
+  in {
+    "/" = zfs "zpool/local/root";
+    "/nix" = zfs "zpool/local/nix";
+    "/tmp" = zfs "zpool/local/tmp";
+
+    "/var" = zfs "zpool/safe/var";
+    "/home" = zfs "zpool/safe/home";
+    "/persist" = zfs "zpool/safe/persist";
+
+    "/boot" = {
+      device = "/dev/disk/by-label/NIXBOOT";
+      fsType = "vfat";
+    };
+  };
+
+  nix.maxJobs = lib.mkDefault 12;
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.enableRedistributableFirmware = true;
+
+  # Laptop, don't autodeploy.
+  my.deploy.enable = false;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # ZFS!
+  services.zfs.rollbackOnBoot.enable = true;
+
+  # Enable libvirtd.
+  virtualisation.libvirtd = {
+    enable = true;
+  };
+
+  networking.hostName = "howl";
+  networking.hostId = "cdd51451";
+
+  # Boot faster.
+  systemd.services.systemd-udev-settle.enable = false;
+  systemd.services.NetworkManager-wait-online.enable = false;
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  # Use NetworkManager instead.
+  networking.useDHCP = false;
+  networking.interfaces.eno1.useDHCP = false;
+  networking.networkmanager.enable = true;
+  #my.ip.tailscale = "100.125.26.108";
+
+  # Set your time zone.
+  time.timeZone = "Europe/London";
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    pciutils
+    deluge
+  ];
+
+  # Enable the X11 windowing system.
+  services.xserver.enable = true;
+  services.xserver.layout = "us";
+  services.xserver.libinput.enable = true;
+  services.xserver.windowManager.i3.enable = true;
+  services.xserver.videoDrivers = [ "intel" ];
+  services.xserver.displayManager.gdm = {
+    enable = true;
+  };
+
+  hardware.opengl.driSupport32Bit = true;
+  hardware.opengl.extraPackages = with pkgs; [
+    intel-media-driver vaapiVdpau libvdpau-va-gl libva
+  ];
+  hardware.opengl.extraPackages32 = with pkgs.pkgsi686Linux; [ libva ];
+  hardware.acpilight.enable = true;
+
+  # TODO(lukegb): finish evaluating pipewire
+  hardware.pulseaudio.enable = lib.mkForce false;
+  services.pipewire = {
+    enable = true;
+    alsa.enable = true;
+    alsa.support32Bit = true;
+    jack.enable = true;
+    pulse.enable = true;
+
+    media-session.enable = true;
+  };
+
+  # Define a user account.
+  users.users.lukegb = {
+    extraGroups = [ "wheel" "networkmanager" "libvirtd" "video" ];
+  };
+  my.home-manager.system = {...}: {
+    home.packages = lib.mkAfter (with pkgs; [
+      steam
+      (writeScriptBin "javaws" ''
+        #!/bin/sh
+        exec ${depot.nix.pkgs.javaws-env}/bin/javaws-env "$@"
+      '')
+      factorio-experimental
+      (depot.nix.pkgs.secretsync.configure {
+        workingDir = "/home/lukegb/depot";
+        gitlabAccessToken = secrets.deployer.gitlabAccessToken;
+        manifestVariable = "SECRETS_MANIFEST";
+        variablesToFile = {
+          "OPS_SECRETS_DEFAULT_NIX" = "ops/secrets/default.nix";
+        };
+      })
+      efibootmgr
+      iw
+      obs-studio
+      vulkan-tools
+    ]);
+  };
+
+  # Things to persist.
+  services.openssh.hostKeys = [
+    {
+      path = "/persist/etc/ssh/ssh_host_ed25519_key";
+      type = "ed25519";
+    }
+    {
+      path = "/persist/etc/ssh/ssh_host_rsa_key";
+      type = "rsa";
+      bits = 4096;
+    }
+  ];
+  environment.etc = {
+    "NetworkManager/system-connections" = {
+      source = "/persist/etc/NetworkManager/system-connections/";
+    };
+  };
+  systemd.tmpfiles.rules = [
+    "d /var/lib/libvirt 0755 root - - -"
+  ];
+  systemd.mounts = let
+    bindMount' = dir: {
+      unitConfig.RequiresMountsFor = dir;
+      options = "bind";
+      what = "/persist${dir}";
+      where = dir;
+    };
+    bindMountSvc = dir: svc: (bindMount' dir) // {
+      bindsTo = [svc];
+      partOf = [svc];
+    };
+    bindMount = dir: (bindMount' dir) // {
+      wantedBy = ["multi-user.target"];
+    };
+  in [
+    (bindMountSvc "/var/lib/libvirt" "libvirtd.service")
+    (bindMount "/root")
+  ];
+
+  # Enable Thunderbolt device management.
+  services.hardware.bolt.enable = true;
+
+  services.avahi.enable = true;
+
+  nix.buildMachines = [ {
+    hostName = "totoro";
+    system = "x86_64-linux";
+    maxJobs = 4;
+    speedFactor = 2;
+    supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+    mandatoryFeatures = [ ];
+  }];
+
+  # This value determines the NixOS release with which your system is to be
+  # compatible, in order to avoid breaking some software such as database
+  # servers. You should change this only after NixOS release notes say you
+  # should.
+  system.stateVersion = "21.05"; # Did you read the comment?
+}
diff --git a/ops/nixos/installcd/default.nix b/ops/nixos/installcd/default.nix
index 77d12d596d..76eefbccba 100644
--- a/ops/nixos/installcd/default.nix
+++ b/ops/nixos/installcd/default.nix
@@ -13,9 +13,7 @@ in {
   isoImage.isoName = lib.mkForce "nixos-${depot.version}-${pkgs.stdenv.hostPlatform.system}.iso";
 
   isoImage.storeContents = [
-    depot.ops.nixos.systems.bvm-twitterchiver
-    depot.ops.nixos.systems.bvm-prosody
-    depot.ops.nixos.systems.bvm-ipfs
+    depot.ops.nixos.systems.howl
   ];
 
   system.stateVersion = "21.05";