diff --git a/install-work.sh b/install-work.sh
new file mode 100755
index 0000000..92fc7e6
--- /dev/null
+++ b/install-work.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly CONFIGURATION="atoll"
+readonly EXPECTED_USER="alakhwara"
+REPO_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+readonly REPO_DIR
+readonly NIX_INSTALLER_URL="https://install.determinate.systems/nix"
+readonly DARWIN_REBUILD="github:LnL7/nix-darwin/nix-darwin-26.05#darwin-rebuild"
+
+if [[ "$(uname -s)" != "Darwin" ]]; then
+  echo "error: install-work.sh only supports macOS" >&2
+  exit 1
+fi
+
+if [[ "$(id -un)" != "$EXPECTED_USER" ]]; then
+  echo "error: the $CONFIGURATION configuration expects user $EXPECTED_USER" >&2
+  echo "current user: $(id -un)" >&2
+  exit 1
+fi
+
+if ! command -v nix >/dev/null 2>&1; then
+  echo "Installing Determinate Nix..."
+  curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
+    "$NIX_INSTALLER_URL" |
+    sh -s -- install --no-confirm
+fi
+
+# The installer updates future shells; load Nix into this process so the
+# bootstrap can continue without asking the user to open another terminal.
+if ! command -v nix >/dev/null 2>&1; then
+  readonly NIX_DAEMON_PROFILE="/nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh"
+  if [[ ! -r "$NIX_DAEMON_PROFILE" ]]; then
+    echo "error: Nix was installed but $NIX_DAEMON_PROFILE is unavailable" >&2
+    exit 1
+  fi
+
+  # shellcheck disable=SC1090
+  source "$NIX_DAEMON_PROFILE"
+fi
+
+NIX_BIN="$(command -v nix)"
+readonly NIX_BIN
+sudo_env=("HOME=$HOME")
+if [[ -n "${SSH_AUTH_SOCK:-}" ]]; then
+  sudo_env+=("SSH_AUTH_SOCK=$SSH_AUTH_SOCK")
+fi
+
+echo "Applying nix-darwin configuration $CONFIGURATION..."
+sudo -v
+sudo env "${sudo_env[@]}" \
+  "$NIX_BIN" --accept-flake-config \
+  run "$DARWIN_REBUILD" -- \
+  switch --flake "$REPO_DIR#$CONFIGURATION"
+
+echo
+echo "Work Mac installation complete. Open a new terminal to load the new environment."