diff --git a/modules/k8s.nix b/modules/k8s.nix
index e4e0f1a..eeac8be 100644
--- a/modules/k8s.nix
+++ b/modules/k8s.nix
@@ -272,6 +272,13 @@ in {
   imports = [./base.nix];
 
   options.kubernetes = {
+    kubeconfig = mkOption {
+      description = "path to kubeconfig file (default: use $KUBECONFIG)";
+      type = types.nullOr types.str;
+      default = null;
+      example = "/run/secrets/kubeconfig";
+    };
+
     version = mkOption {
       description = "Kubernetes version to use";
       type = types.enum versions;
diff --git a/pkgs/kubenix.nix b/pkgs/kubenix.nix
index faceadd..573f208 100644
--- a/pkgs/kubenix.nix
+++ b/pkgs/kubenix.nix
@@ -60,6 +60,10 @@ writeShellScriptBin "kubenix" ''
   # if no args given, add empty string
   [ $# -eq 0 ] && set -- ""
 
+  # use kubeconfig, if given
+  kubeconfig=$(nix eval '.#kubenix.config.kubernetes.kubeconfig' --raw)
+  [ -n "$kubeconfig" ] && export KUBECONFIG=$kubeconfig
+
   # parse arguments
   while test $# -gt 0; do
     case "$1" in