diff --git a/flake.nix b/flake.nix
index e1f2353..852694f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -92,6 +92,32 @@
       };
     };
 
+    apps.${system}.default = let
+      inherit (self.nixosConfigurations.vm.config.system.build) vm;
+      inherit (nixpkgs.legacyPackages.${system}) writeShellScript;
+      inherit (nixpkgs.lib.attrsets) mapAttrsToList;
+      inherit (nixpkgs.lib.strings) concatStringsSep;
+      ports = {
+        "2222" = "2222";
+        "3080" = "80";
+        "3443" = "443";
+        "2221" = "2221";
+        "21025" = "21025"; # Starbound
+      };
+      QEMU_NET_OPTS =
+        concatStringsSep ","
+        (mapAttrsToList
+          (host: vm: "hostfwd=::${host}-:${vm}")
+          ports);
+    in {
+      type = "app";
+      program = builtins.toString (writeShellScript "run-vm" ''
+        export QEMU_OPTS="-m 3941 -smp 2 -curses"
+        export QEMU_NET_OPTS="${QEMU_NET_OPTS}"
+        "${vm}/bin/run-tlaternet-vm"
+      '');
+    };
+
     devShells.${system}.default = pkgs.mkShell {
       sopsPGPKeyDirs = ["./keys/hosts/" "./keys/users/"];
       nativeBuildInputs = [
@@ -103,25 +129,7 @@
         sops-pkgs.sops-init-gpg-key
       ];
 
-      shellHook = let
-        inherit (pkgs.lib.attrsets) mapAttrsToList;
-        inherit (pkgs.lib.strings) concatStringsSep;
-        ports = {
-          "2222" = "2222";
-          "3080" = "80";
-          "3443" = "443";
-          "2221" = "2221";
-          "21025" = "21025"; # Starbound
-        };
-        QEMU_NET_OPTS =
-          concatStringsSep ","
-          (mapAttrsToList
-            (host: vm: "hostfwd=::${host}-:${vm}")
-            ports);
-      in ''
-        export QEMU_OPTS="-m 3941 -smp 2 -curses"
-        export QEMU_NET_OPTS="${QEMU_NET_OPTS}"
-
+      shellHook = ''
         # Work around sudo requiring a full terminal when deploying to
         # a remote host
         export NIX_SSHOPTS="-t"