diff --git a/default.nix b/default.nix
index 3c174ca13e5..f0020c5a1a6 100644
--- a/default.nix
+++ b/default.nix
@@ -7,6 +7,11 @@ let
     (import ./lib/eval-config.nix {inherit configuration;})
     config optionDeclarations pkgs;
 
+  vmConfig = (import ./lib/eval-config.nix {
+    inherit configuration;
+    extraModules = [./modules/virtualisation/qemu-vm.nix];
+  }).config;
+    
 in
 
 {
@@ -14,6 +19,8 @@ in
 
   system = config.system.build.system;
 
+  vm = vmConfig.system.build.vm;
+
   # The following are used by nixos-rebuild.
   nixFallback = pkgs.nixUnstable;
   manifests = config.installer.manifests;
diff --git a/lib/eval-config.nix b/lib/eval-config.nix
index 9dccc62e1ec..9d6c5794df1 100644
--- a/lib/eval-config.nix
+++ b/lib/eval-config.nix
@@ -7,6 +7,7 @@
 , nixpkgs ? import ./from-env.nix "NIXPKGS" /etc/nixos/nixpkgs
 , pkgs ? import nixpkgs {inherit system;}
 , extraArgs ? {}
+, extraModules ? []
 }:
 
 let extraArgs_ = extraArgs; in
@@ -14,10 +15,12 @@ let extraArgs_ = extraArgs; in
 rec {
   inherit nixpkgs pkgs;
 
-  configComponents = [
-    configuration
-    ./check-config.nix
-  ] ++ (import ../modules/module-list.nix);
+  configComponents =
+    [ configuration
+      ./check-config.nix
+    ]
+    ++ extraModules
+    ++ (import ../modules/module-list.nix);
 
   extraArgs = extraArgs_ // {
     inherit pkgs;
diff --git a/modules/installer/tools/nixos-rebuild.sh b/modules/installer/tools/nixos-rebuild.sh
index cd2329416ab..86b7337beac 100644
--- a/modules/installer/tools/nixos-rebuild.sh
+++ b/modules/installer/tools/nixos-rebuild.sh
@@ -15,12 +15,14 @@ Usage: $0 [OPTIONS...] OPERATION
 
 The operation is one of the following:
 
-  switch:  make the configuration the boot default and activate now
-  boot:    make the configuration the boot default
-  test:    activate the configuration, but don't make it the boot default
-  build:   build the configuration, but don't make it the default or
-           activate it
-  dry-run: just show what store paths would be built/downloaded
+  switch:   make the configuration the boot default and activate now
+  boot:     make the configuration the boot default
+  test:     activate the configuration, but don't make it the boot default
+  build:    build the configuration, but don't make it the default or
+            activate it
+  build-vm: build a virtual machine containing the configuration
+            (useful for testing)
+  dry-run:  just show what store paths would be built/downloaded
 
 Options:
 
@@ -54,7 +56,8 @@ while test "$#" -gt 0; do
     i="$1"; shift 1
     if test "$i" = "--help"; then
         showSyntax
-    elif test "$i" = switch -o "$i" = boot -o "$i" = test -o "$i" = build -o "$i" = dry-run; then
+    elif test "$i" = switch -o "$i" = boot -o "$i" = test -o "$i" = build \
+        -o "$i" = dry-run -o "$i" = build-vm; then
         action="$i"
     elif test "$i" = --install-grub; then
         export NIXOS_INSTALL_GRUB=1
@@ -129,6 +132,9 @@ if test "$action" = switch -o "$action" = boot; then
 elif test "$action" = test -o "$action" = build -o "$action" = dry-run; then
     nix-build $NIXOS -A system -K -k $extraBuildFlags
     pathToConfig=./result
+elif test "$action" = build-vm; then
+    nix-build $NIXOS -A vm -K -k $extraBuildFlags
+    pathToConfig=./result
 else
     showSyntax
 fi
@@ -141,7 +147,7 @@ if test "$action" = switch -o "$action" = boot -o "$action" = test; then
 fi
 
 
-if test "$action" = "test"; then
+if test "$action" = test; then
     cat >&2 <<EOF
 
 Warning: if you remove or overwrite the symlink \`$pathToConfig', the
@@ -149,3 +155,11 @@ active system configuration may be garbage collected!  This may render
 the system inoperable (though a reboot will fix things).
 EOF
 fi
+
+
+if test "$action" = build-vm; then
+    cat >&2 <<EOF
+
+Done.  The virtual machine can be started by running $(echo $pathToConfig/bin/run-*-vm).
+EOF
+fi
diff --git a/modules/services/networking/ssh/sshd.nix b/modules/services/networking/ssh/sshd.nix
index ca072e92084..a3ca7d84c46 100644
--- a/modules/services/networking/ssh/sshd.nix
+++ b/modules/services/networking/ssh/sshd.nix
@@ -5,9 +5,7 @@ let
   inherit (pkgs.lib) mkOption mkIf;
   inherit (pkgs) openssh;
 
-  cfg = (config.services.sshd);
-
-  nssModules = config.system.nssModules.list;
+  cfg = config.services.sshd;
 
   nssModulesPath = config.system.nssModules.path;
 
diff --git a/modules/virtualisation/qemu-vm.nix b/modules/virtualisation/qemu-vm.nix
index d8ab12daa93..a5329b0d297 100644
--- a/modules/virtualisation/qemu-vm.nix
+++ b/modules/virtualisation/qemu-vm.nix
@@ -85,8 +85,12 @@ in
     '';
 
   # Mount the host filesystem via CIFS, and bind-mount the Nix store
-  # of the host into our own filesystem.
-  fileSystems =
+  # of the host into our own filesystem.  We use mkOverride to allow
+  # this module to be applied to "normal" NixOS system configuration,
+  # where the regular value for the `fileSystems' attribute should be
+  # disregarded for the purpose of building a VM test image (since
+  # those filesystems don't exist in the VM).
+  fileSystems = pkgs.lib.mkOverride 50 {}
     [ { mountPoint = "/";
         device = "/dev/vda";
       }