diff --git a/default.nix b/default.nix
index b853fc32..a2528d3f 100644
--- a/default.nix
+++ b/default.nix
@@ -44,6 +44,7 @@ let
         ./modules/environment
         ./modules/launchd
         ./modules/services/activate-system
+        ./modules/services/buildkite-agent.nix
         ./modules/services/chunkwm.nix
         ./modules/services/emacs.nix
         ./modules/services/khd
diff --git a/modules/services/buildkite-agent.nix b/modules/services/buildkite-agent.nix
new file mode 100644
index 00000000..96c2f3b3
--- /dev/null
+++ b/modules/services/buildkite-agent.nix
@@ -0,0 +1,237 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.buildkite-agent;
+
+  mkHookOption = { name, description, example ? null }: {
+    inherit name;
+    value = mkOption {
+      default = null;
+      inherit description;
+      type = types.nullOr types.lines;
+    } // (if example == null then {} else { inherit example; });
+  };
+  mkHookOptions = hooks: listToAttrs (map mkHookOption hooks);
+
+  hooksDir = let
+    mkHookEntry = name: value: ''
+      cat > $out/${name} <<EOF
+      #! ${pkgs.stdenv.shell}
+      set -e
+      ${value}
+      EOF
+      chmod 755 $out/${name}
+    '';
+  in pkgs.runCommand "buildkite-agent-hooks" {} ''
+    mkdir $out
+    ${concatStringsSep "\n" (mapAttrsToList mkHookEntry (filterAttrs (n: v: v != null) cfg.hooks))}
+  '';
+
+in
+
+{
+  options = {
+    services.buildkite-agent.enable = mkEnableOption "buildkite-agent";
+
+    services.buildkite-agent.package = mkOption {
+      default = pkgs.buildkite-agent;
+      defaultText = "pkgs.buildkite-agent";
+      description = "Which buildkite-agent derivation to use";
+      type = types.package;
+    };
+
+    services.buildkite-agent.dataDir = mkOption {
+      default = "/var/lib/buildkite-agent";
+      description = "The workdir for the agent";
+      type = types.str;
+    };
+
+    services.buildkite-agent.runtimePackages = mkOption {
+      default = [ pkgs.bash pkgs.nix ];
+      defaultText = "[ pkgs.bash pkgs.nix ]";
+      description = "Add programs to the buildkite-agent environment";
+      type = types.listOf types.package;
+    };
+
+    services.buildkite-agent.tokenPath = mkOption {
+      type = types.path;
+      description = ''
+        The token from your Buildkite "Agents" page.
+
+        A run-time path to the token file, which is supposed to be provisioned
+        outside of Nix store.
+      '';
+    };
+
+    services.buildkite-agent.name = mkOption {
+      type = types.str;
+      default = "%hostname-%n";
+      description = ''
+        The name of the agent.
+      '';
+    };
+
+    services.buildkite-agent.meta-data = mkOption {
+      type = types.str;
+      default = "";
+      example = "queue=default,docker=true,ruby2=true";
+      description = ''
+        Meta data for the agent. This is a comma-separated list of
+        <code>key=value</code> pairs.
+      '';
+    };
+
+    services.buildkite-agent.extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      example = "debug=true";
+      description = ''
+        Extra lines to be added verbatim to the configuration file.
+      '';
+    };
+
+    services.buildkite-agent.openssh =
+      { privateKeyPath = mkOption {
+          type = types.path;
+          description = ''
+            Private agent key.
+
+            A run-time path to the key file, which is supposed to be provisioned
+            outside of Nix store.
+          '';
+        };
+        publicKeyPath = mkOption {
+          type = types.path;
+          description = ''
+            Public agent key.
+
+            A run-time path to the key file, which is supposed to be provisioned
+            outside of Nix store.
+          '';
+        };
+      };
+
+    services.buildkite-agent.hooks = mkHookOptions [
+      { name = "checkout";
+        description = ''
+          The `checkout` hook script will replace the default checkout routine of the
+          bootstrap.sh script. You can use this hook to do your own SCM checkout
+          behaviour
+        ''; }
+      { name = "command";
+        description = ''
+          The `command` hook script will replace the default implementation of running
+          the build command.
+        ''; }
+      { name = "environment";
+        description = ''
+          The `environment` hook will run before all other commands, and can be used
+          to set up secrets, data, etc. Anything exported in hooks will be available
+          to the build script.
+
+          Note: the contents of this file will be copied to the world-readable
+          Nix store.
+        '';
+        example = ''
+          export SECRET_VAR=`head -1 /run/keys/secret`
+        ''; }
+      { name = "post-artifact";
+        description = ''
+          The `post-artifact` hook will run just after artifacts are uploaded
+        ''; }
+      { name = "post-checkout";
+        description = ''
+          The `post-checkout` hook will run after the bootstrap script has checked out
+          your projects source code.
+        ''; }
+      { name = "post-command";
+        description = ''
+          The `post-command` hook will run after the bootstrap script has run your
+          build commands
+        ''; }
+      { name = "pre-artifact";
+        description = ''
+          The `pre-artifact` hook will run just before artifacts are uploaded
+        ''; }
+      { name = "pre-checkout";
+        description = ''
+          The `pre-checkout` hook will run just before your projects source code is
+          checked out from your SCM provider
+        ''; }
+      { name = "pre-command";
+        description = ''
+          The `pre-command` hook will run just before your build command runs
+        ''; }
+      { name = "pre-exit";
+        description = ''
+          The `pre-exit` hook will run just before your build job finishes
+        ''; }
+    ];
+  };
+
+  config = mkIf config.services.buildkite-agent.enable {
+    users.users.buildkite-agent =
+      { name = "buildkite-agent";
+        home = cfg.dataDir;
+        description = "Buildkite agent user";
+      };
+    users.groups.buildkite-agent =
+      { name = "buildkite-agent";
+        description = "Buildkite agent user group";
+      };
+
+    environment.systemPackages = [ cfg.package ];
+
+    launchd.daemons.buildkite-agent =
+      {
+        path = cfg.runtimePackages ++ [ pkgs.coreutils cfg.package ]
+          ++ (if pkgs.stdenv.isDarwin then [ pkgs.darwin.DarwinTools ] else []);
+        environment = {
+          HOME = cfg.dataDir;
+          NIX_SSL_CERT_FILE = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+        } // (if config.nix.useDaemon then { NIX_REMOTE = "daemon"; } else {});
+
+        ## NB: maximum care is taken so that secrets (ssh keys and the CI token)
+        ##     don't end up in the Nix store.
+        script = let
+          sshDir = "${cfg.dataDir}/.ssh";
+        in
+          ''
+            mkdir -m 0700 -p "${sshDir}"
+            cp -f "${toString cfg.openssh.privateKeyPath}" "${sshDir}/id_rsa"
+            cp -f "${toString cfg.openssh.publicKeyPath}"  "${sshDir}/id_rsa.pub"
+            chmod 600 "${sshDir}"/id_rsa*
+
+            cat > "${cfg.dataDir}/buildkite-agent.cfg" <<EOF
+            token="$(cat ${toString cfg.tokenPath})"
+            name="${cfg.name}"
+            meta-data="${cfg.meta-data}"
+            build-path="${cfg.dataDir}/builds"
+            hooks-path="${hooksDir}"
+            ${cfg.extraConfig}
+            EOF
+
+            # Secrets exist in the buildkite-agent home directory
+            chmod 750 "${cfg.dataDir}"
+            chmod 640 "${cfg.dataDir}/buildkite-agent.cfg"
+
+            exec buildkite-agent start --config "${cfg.dataDir}/buildkite-agent.cfg"
+          '';
+
+        serviceConfig = {
+          KeepAlive = true;
+          RunAtLoad = true;
+          ProcessType = "Interactive";
+          ThrottleInterval = 30;
+
+          GroupName = "buildkite-agent";
+          UserName = "buildkite-agent";
+          WorkingDirectory = config.users.users.buildkite-agent.home;
+          StandardErrorPath = "${cfg.dataDir}/buildkite-agent.log";
+          StandardOutPath = "${cfg.dataDir}/buildkite-agent.log";
+        };
+      };
+  };
+}
diff --git a/release.nix b/release.nix
index 4e9b31fe..e952500d 100644
--- a/release.nix
+++ b/release.nix
@@ -105,6 +105,7 @@ let
     tests.system-path-fish = makeTest ./tests/system-path-fish.nix;
     tests.system-shells = makeTest ./tests/system-shells.nix;
     tests.users-groups = makeTest ./tests/users-groups.nix;
+    tests.buildkite-agent = makeTest ./tests/buildkite-agent.nix;
 
   }
   // (mapTestOn (packagePlatforms packageSet));
diff --git a/tests/buildkite-agent.nix b/tests/buildkite-agent.nix
new file mode 100644
index 00000000..29f321e4
--- /dev/null
+++ b/tests/buildkite-agent.nix
@@ -0,0 +1,24 @@
+{ config, pkgs, ... }:
+
+let
+  tokenPath = pkgs.writeText "buildkite_token" "TEST_TOKEN";
+in {
+  services.buildkite-agent = {
+    enable = true;
+    extraConfig = "yolo=1";
+    openssh.privateKeyPath = "/dev/null";
+    openssh.publicKeyPath = "/dev/null";
+    hooks.command = "echo test";
+    inherit tokenPath;
+  };
+
+  test = ''
+    echo "checking buildkite-agent service in /Library/LaunchDaemons" >&2
+    grep "org.nixos.buildkite-agent" ${config.out}/Library/LaunchDaemons/org.nixos.buildkite-agent.plist
+
+    echo "checking creation of buildkite-agent service config" >&2
+    script=$(cat ${config.out}/Library/LaunchDaemons/org.nixos.buildkite-agent.plist | awk -F'[< ]' '$3 ~ "^/nix/store/.*" {print $3}')
+    grep "yolo=1" "$script"
+    grep "${tokenPath}" "$script"
+  '';
+}