diff --git a/default.nix b/default.nix
index fda19c3a149..ca69f07ef31 100644
--- a/default.nix
+++ b/default.nix
@@ -1,12 +1,15 @@
 { configuration ? import ./lib/from-env.nix "NIXOS_CONFIG" <nixos-config>
+, extraModulesPath ? builtins.getEnv "NIXOS_EXTRA_MODULES" 
 , system ? builtins.currentSystem
 }:
 
 let
 
+  extraModules = if extraModulesPath == "" then [] else import extraModulesPath;
+
   eval = import ./lib/eval-config.nix {
     inherit system;
-    modules = [ configuration ];
+    modules = [ configuration ] ++ extraModules;
   };
 
   inherit (eval) config pkgs;
@@ -14,7 +17,7 @@ let
   # This is for `nixos-rebuild build-vm'.
   vmConfig = (import ./lib/eval-config.nix {
     inherit system;
-    modules = [ configuration ./modules/virtualisation/qemu-vm.nix ];
+    modules = [ configuration ./modules/virtualisation/qemu-vm.nix ] ++ extraModules;
   }).config;
 
   # This is for `nixos-rebuild build-vm-with-bootloader'.
@@ -24,7 +27,7 @@ let
       [ configuration
         ./modules/virtualisation/qemu-vm.nix
         { virtualisation.useBootLoader = true; }
-      ];
+      ] ++ extraModules;
   }).config;
 
 in
diff --git a/modules/security/sudo.nix b/modules/security/sudo.nix
index 76c325d8d8f..aac592619c5 100644
--- a/modules/security/sudo.nix
+++ b/modules/security/sudo.nix
@@ -35,6 +35,7 @@ in
           # Environment variables to keep for root and %wheel.
           Defaults:root,%wheel env_keep+=LOCALE_ARCHIVE
           Defaults:root,%wheel env_keep+=NIX_PATH
+          Defaults:root,%wheel env_keep+=NIXOS_EXTRA_MODULES
           Defaults:root,%wheel env_keep+=TERMINFO_DIRS
 
           # Keep SSH_AUTH_SOCK so that pam_ssh_agent_auth.so can do its magic.