diff --git a/flake.lock b/flake.lock
index 2e4feb5..d8398eb 100644
--- a/flake.lock
+++ b/flake.lock
@@ -1,5 +1,25 @@
 {
   "nodes": {
+    "atm-tui": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1774249805,
+        "narHash": "sha256-NLRIrb6fLYx9qkIMX+5yOLQdLTkXKAeeEaKrk96sYvw=",
+        "ref": "refs/heads/main",
+        "rev": "e28ba583d95597ad0b79c307dca8b19cb1d601c3",
+        "revCount": 20,
+        "type": "git",
+        "url": "ssh://forgejo@git.atitlan.io/aiolabs/atm-tui.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "ssh://forgejo@git.atitlan.io/aiolabs/atm-tui.git"
+      }
+    },
     "cachix": {
       "inputs": {
         "devenv": [
@@ -479,6 +499,7 @@
     },
     "root": {
       "inputs": {
+        "atm-tui": "atm-tui",
         "determinate": "determinate",
         "devenv": "devenv",
         "flake-utils": "flake-utils",
diff --git a/flake.nix b/flake.nix
index a95827e..9d4d22d 100644
--- a/flake.nix
+++ b/flake.nix
@@ -23,9 +23,15 @@
     # Determinate Nix — ensures douro uses same nix version as dev machines
     # so cachix binary cache hits match (nix 2.33 hashes == nix 2.33 hashes)
     determinate.url = "https://flakehub.com/f/DeterminateSystems/determinate/3";
+
+    # ATM TUI — operator management tool
+    atm-tui = {
+      url = "git+ssh://forgejo@git.atitlan.io/aiolabs/atm-tui.git";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
   };
 
-  outputs = { self, nixpkgs, nixpkgs-unstable, flake-utils, rust-overlay, devenv, determinate }:
+  outputs = { self, nixpkgs, nixpkgs-unstable, flake-utils, rust-overlay, devenv, determinate, atm-tui }:
     let
       system = "x86_64-linux";
 
@@ -71,6 +77,7 @@
           modules = [
             ./deploy/nixos/live.nix
             determinate.nixosModules.default
+            { environment.systemPackages = [ atm-tui.packages.${system}.default ]; }
           ];
         };
 
@@ -101,6 +108,9 @@
                 appDir = "${atm-app}";
               };
 
+              # Operator TUI for local machine management
+              environment.systemPackages = [ atm-tui.packages.${system}.default ];
+
               # Electron sandbox needs unprivileged user namespaces
               boot.kernel.sysctl."kernel.unprivileged_userns_clone" = 1;