diff --git a/appview/pages/pages.go b/appview/pages/pages.go
index e2f0c58c..6c44f14b 100644
--- a/appview/pages/pages.go
+++ b/appview/pages/pages.go
@@ -132,6 +132,7 @@ func (p *Pages) Knot(w io.Writer, params KnotParams) error {
 
 type NewRepoParams struct {
 	LoggedInUser *auth.User
+	Knots        []string
 }
 
 func (p *Pages) NewRepo(w io.Writer, params NewRepoParams) error {
diff --git a/appview/pages/templates/repo/new.html b/appview/pages/templates/repo/new.html
index f4fe0d87..ab2c417a 100644
--- a/appview/pages/templates/repo/new.html
+++ b/appview/pages/templates/repo/new.html
@@ -6,9 +6,19 @@
     <label for="name">repo name</label>
     <input type="text" id="name" name="name" required />
 
-    <label for="domain">domain</label>
-    <input type="domain" id="domain" name="domain" required />
+    <br>
+
+    <fieldset>
+      <legend>select a knot:</legend>
+      {{ range .Knots }}
+      <label>
+        <input type="radio" name="domain" value="{{ . }}"> {{ . }}
+      </label><br>
+      <button type="submit">create repo</button>
+      {{ else }}
+      <p>no knots available</p>
+      {{ end }}
+    </fieldset>
 
-    <button type="submit">create repo</button>
 </form>
 {{end}}
diff --git a/appview/state/state.go b/appview/state/state.go
index c901b71c..77980a22 100644
--- a/appview/state/state.go
+++ b/appview/state/state.go
@@ -490,8 +490,17 @@ func (s *State) RemoveMember(w http.ResponseWriter, r *http.Request) {
 func (s *State) AddRepo(w http.ResponseWriter, r *http.Request) {
 	switch r.Method {
 	case http.MethodGet:
+		user := s.auth.GetUser(r)
+		knots, err := s.enforcer.GetDomainsForUser(user.Did)
+
+		if err != nil {
+			log.Println("invalid user?", err)
+			return
+		}
+
 		s.pages.NewRepo(w, pages.NewRepoParams{
-			LoggedInUser: s.auth.GetUser(r),
+			LoggedInUser: user,
+			Knots:        knots,
 		})
 	case http.MethodPost:
 		user := s.auth.GetUser(r)
diff --git a/rbac/rbac.go b/rbac/rbac.go
index bc8e854e..a08e4fad 100644
--- a/rbac/rbac.go
+++ b/rbac/rbac.go
@@ -80,6 +80,10 @@ func (e *Enforcer) AddDomain(domain string) error {
 	return err
 }
 
+func (e *Enforcer) GetDomainsForUser(did string) ([]string, error) {
+	return e.E.Enforcer.GetDomainsForUser(did)
+}
+
 func (e *Enforcer) AddOwner(domain, owner string) error {
 	_, err := e.E.AddGroupingPolicy(owner, "server:owner", domain)
 	return err