diff --git a/hosts/ni/default.nix b/hosts/ni/default.nix
index d8eb77e3..020338f8 100644
--- a/hosts/ni/default.nix
+++ b/hosts/ni/default.nix
@@ -135,7 +135,6 @@
   environment.systemPackages = with pkgs; [
     # Some sysadmin thingamajigs.
     openldap
-    wireguard-tools
 
     # For debugging build environments in Nix packages.
     cntr
diff --git a/hosts/ni/modules/wireguard.nix b/hosts/ni/modules/wireguard.nix
index e1704905..1c4de7dc 100644
--- a/hosts/ni/modules/wireguard.nix
+++ b/hosts/ni/modules/wireguard.nix
@@ -25,6 +25,7 @@ in
   # be used anywhere, we're configuring Wireguard here as a "client".
   config = lib.mkMerge [
     {
+      environment.systemPackages = with pkgs; [ wireguard-tools ];
       networking.firewall.allowedUDPPorts = [ wireguardPort ];
       sops.secrets = lib.getSecrets ../secrets/secrets.yaml {
         "wireguard/private-key" = { };