diff --git a/modules/hosts/euclid/default.nix b/modules/hosts/euclid/default.nix
index 082946f..f04fc21 100644
--- a/modules/hosts/euclid/default.nix
+++ b/modules/hosts/euclid/default.nix
@@ -24,6 +24,7 @@
       mysql
       postgres
       protonWireguard
+      spindleMicrovm
       traefik
       valkey
       wireguard
diff --git a/modules/profiles/personal.nix b/modules/profiles/personal.nix
index 219be4c..4fad655 100644
--- a/modules/profiles/personal.nix
+++ b/modules/profiles/personal.nix
@@ -41,6 +41,7 @@
       printing
       ssh-stunnel
       upower
+      virtManager
       # keep-sorted end
     ];
 
diff --git a/modules/programs/gui/virt-manager.nix b/modules/programs/gui/virt-manager.nix
new file mode 100644
index 0000000..dc6a790
--- /dev/null
+++ b/modules/programs/gui/virt-manager.nix
@@ -0,0 +1,34 @@
+{self, ...}: {
+  flake.modules.nixos.virtManager = {
+    # keep-sorted start
+    pkgs,
+    vars,
+    # keep-sorted end
+    ...
+  }: let
+    inherit (vars) username;
+  in {
+    imports = [self.modules.nixos.virtualizationHost];
+
+    programs.virt-manager.enable = true;
+
+    users.users.${username}.extraGroups = ["libvirtd"];
+
+    virtualisation.libvirtd = {
+      enable = true;
+      onBoot = "ignore";
+      qemu = {
+        package = pkgs.qemu_kvm;
+        swtpm.enable = true;
+      };
+    };
+
+    # Trusts the default libvirt bridge and keeps NetworkManager from managing it.
+    networking = let
+      interface = ["virbr0"];
+    in {
+      firewall.trustedInterfaces = interface;
+      networkmanager.unmanaged = interface;
+    };
+  };
+}
diff --git a/modules/services/hardware/virtualization-host.nix b/modules/services/hardware/virtualization-host.nix
new file mode 100644
index 0000000..8b41587
--- /dev/null
+++ b/modules/services/hardware/virtualization-host.nix
@@ -0,0 +1,9 @@
+{
+  flake.modules.nixos.virtualizationHost = {vars, ...}: let
+    inherit (vars) username;
+  in {
+    boot.kernelModules = ["kvm-intel"];
+
+    users.users.${username}.extraGroups = ["kvm"];
+  };
+}
diff --git a/modules/services/server/spindle-microvm.nix b/modules/services/server/spindle-microvm.nix
new file mode 100644
index 0000000..7500dd3
--- /dev/null
+++ b/modules/services/server/spindle-microvm.nix
@@ -0,0 +1,25 @@
+{self, ...}: {
+  flake.modules.nixos.spindleMicrovm = {pkgs, ...}: {
+    imports = [self.modules.nixos.virtualizationHost];
+
+    boot.kernelModules = [
+      # keep-sorted start
+      "tun"
+      "vhost_vsock"
+      "vsock_loopback"
+      # keep-sorted end
+    ];
+
+    # Makes host tools available for read-only bind mounting.
+    environment.systemPackages = [
+      # keep-sorted start
+      pkgs.e2fsprogs
+      pkgs.iproute2
+      pkgs.nix
+      pkgs.qemu
+      pkgs.slirp4netns
+      pkgs.util-linux
+      # keep-sorted end
+    ];
+  };
+}