diff --git a/conf.d/vm.mk b/conf.d/vm.mk
index b8ab69c..eac35b9 100644
--- a/conf.d/vm.mk
+++ b/conf.d/vm.mk
@@ -22,4 +22,7 @@ vm/icewm-setup: vm/.desktop-bare mixin/icewm use/oem use/x11-autostart
 	@$(call add,THE_BRANDING,graphics)
 	@$(call add,THE_LISTS,$(call tags,base l10n))
 
+vm/vagrant-base: vm/net use/vagrant
+	@$(call set,KFLAVOURS,led-ws)
+
 endif
diff --git a/features.in/vagrant/authorized_keys b/features.in/vagrant/authorized_keys
new file mode 100644
index 0000000..18a9c00
--- /dev/null
+++ b/features.in/vagrant/authorized_keys
@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key
diff --git a/features.in/vagrant/config.mk b/features.in/vagrant/config.mk
new file mode 100644
index 0000000..eed685e
--- /dev/null
+++ b/features.in/vagrant/config.mk
@@ -0,0 +1,3 @@
+use/vagrant: use/vmguest/vbox use/deflogin use/net-ssh
+	@$(call add_feature)
+	@$(call add,USERS,vagrant:vagrant:1:1)
diff --git a/features.in/vagrant/rootfs/image-scripts.d/50-vagrant b/features.in/vagrant/rootfs/image-scripts.d/50-vagrant
new file mode 100755
index 0000000..e21db21
--- /dev/null
+++ b/features.in/vagrant/rootfs/image-scripts.d/50-vagrant
@@ -0,0 +1,16 @@
+#!/bin/sh
+# NB: 50-vargant > 50-users
+
+# https://raw.github.com/mitchellh/vagrant/master/keys/vagrant.pub
+pubkey="ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key"
+sshkeys=~vagrant/.ssh/authorized_keys
+install -pDm400 -o vagrant -g vagrant /dev/null "$sshkeys"
+echo "$pubkey" > "$sshkeys"
+
+### FIXME: check if this works
+sudocfg=/etc/sudoers.d/vagrant
+install -pDm400 /dev/null "$sudocfg"
+cat > "$sudocfg" << EOF
+Defaults:vagrant  !requiretty
+vagrant ALL=(ALL) NOPASSWD:ALL
+EOF