diff --git a/modules/kolide-launcher/default.nix b/modules/kolide-launcher/default.nix
index 40dbff4..75bf97a 100644
--- a/modules/kolide-launcher/default.nix
+++ b/modules/kolide-launcher/default.nix
@@ -87,6 +87,14 @@ in
       '';
     };
 
+    osqueryFlags = mkOption {
+      type = types.listOf types.str;
+      default = [];
+      description = ''
+        Flags to pass to osquery (possibly overriding Launcher defaults).
+      '';
+    };
+
     localdevPath = mkOption {
       type = types.nullOr types.path;
       default = null;
@@ -124,10 +132,11 @@ in
             "--autoupdate_interval ${cfg.autoupdateInterval}"
             "--autoupdater_initial_delay ${cfg.autoupdaterInitialDelay}"
           ]
-            ++ optional cfg.insecureTransport "--insecure_transport"
-            ++ optional cfg.insecureTLS "--insecure"
-            ++ optional (!builtins.isNull cfg.localdevPath) "--localdev_path ${cfg.localdevPath}"
-          );
+          ++ optional cfg.insecureTransport "--insecure_transport"
+          ++ optional cfg.insecureTLS "--insecure"
+          ++ optional (!builtins.isNull cfg.localdevPath) "--localdev_path ${cfg.localdevPath}"
+          ++ map (x: "--osquery_flag ${x}") cfg.osqueryFlags
+        );
         Restart = "on-failure";
         RestartSec = 3;
       };