diff --git a/jupiter/configuration.nix b/jupiter/configuration.nix
index 0164760..fea0d17 100644
--- a/jupiter/configuration.nix
+++ b/jupiter/configuration.nix
@@ -19,6 +19,10 @@
   # hardware-configuration.nix) or stage-1 can't mount root and the box panics.
   boot.initrd.availableKernelModules = [ "mmc_block" "sdhci_pci" "sdhci_acpi" ];
 
+  # Trust wheel users so `nixos-rebuild --target-host darman@…` can push a
+  # laptop-built (unsigned) closure without a signature error.
+  nix.settings.trusted-users = [ "root" "@wheel" ];
+
   # ---- NAS data array ----
   # Existing ext4 on the mdadm RAID0 over sda+sdb (md0, 29.1T).
   # Mounted, NOT formatted; kept out of disko so it is never wiped.