diff --git a/hosts/darwin.nix b/hosts/darwin.nix
--- a/hosts/darwin.nix
+++ b/hosts/darwin.nix
@@ -1,4 +1,8 @@
 {
+  imports = [
+    ../modules/system/auto-upgrade-darwin.nix
+  ];
+
   system.defaults.NSGlobalDomain.AppleFontSmoothing = 0; # https://tonsky.me/blog/monitors/
 
   security.pam.services.sudo_local.touchIdAuth = true;
diff --git a/modules/system/auto-upgrade-darwin.nix b/modules/system/auto-upgrade-darwin.nix
new file mode 100644
--- /dev/null
+++ b/modules/system/auto-upgrade-darwin.nix
@@ -0,0 +1,20 @@
+{ ... }:
+{
+  launchd.daemons.darwin-auto-upgrade = {
+    script = ''
+      export PATH="/run/current-system/sw/bin:$PATH"
+      exec darwin-rebuild switch --flake git+ssh://git@knot.starhaven.dev/bates64.com/infra -L
+    '';
+    serviceConfig = {
+      StartCalendarInterval = [
+        {
+          Hour = 4;
+          Minute = 40;
+        }
+      ];
+      StandardOutPath = "/var/log/darwin-auto-upgrade.log";
+      StandardErrorPath = "/var/log/darwin-auto-upgrade.log";
+      RunAtLoad = false;
+    };
+  };
+}