diff --git a/.gitignore b/.gitignore
index 21ac22e..7631a7b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 result*
 /configuration.nix
 /.direnv/
+*.qcow2
diff --git a/base.nix b/base.nix
index 092cce2..c19192d 100644
--- a/base.nix
+++ b/base.nix
@@ -130,4 +130,12 @@
     acceptTerms = true;
     defaults.email = "drift@pvv.ntnu.no";
   };
+  # Let's not spam LetsEncrypt in `nixos-rebuild build-vm` mode:
+  virtualisation.vmVariant = {
+    security.acme.defaults.server = "https://127.0.0.1";
+    security.acme.preliminarySelfsigned = true;
+
+    users.users.root.initialPassword = "root";
+  };
+
 }
diff --git a/justfile b/justfile
index 41dca72..94be674 100644
--- a/justfile
+++ b/justfile
@@ -10,6 +10,10 @@ check:
 build-machine machine=`just _a_machine`:
   {{nom}} build .#nixosConfigurations.{{ machine }}.config.system.build.toplevel
 
+run-vm machine=`just _a_machine`:
+  nixos-rebuild build-vm --flake .#{{ machine }}
+  QEMU_NET_OPTS="hostfwd=tcp::8080-:80,hostfwd=tcp::8081-:443,hostfwd=tcp::2222-:22" ./result/bin/run-*-vm
+
 @update-inputs:
   nix eval .#inputs --apply builtins.attrNames --json \
     | jq '.[]' -r \