diff --git a/flake.lock b/flake.lock
index 6666f7e..c4f8f4c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -26,11 +26,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1738834647,
-        "narHash": "sha256-NdetLk2Ie+syABcq/1MWSpqInhkODItR0xRkwDvWlpk=",
+        "lastModified": 1739094937,
+        "narHash": "sha256-LemSQ5AZHwl4ZVlirdpAytDWgS96OZsct7Akx/REdGA=",
         "owner": "catppuccin",
         "repo": "nix",
-        "rev": "7f2e0e709ad3e47a2ae0e735168438144c134947",
+        "rev": "aee0cec463e62702751adaeb9f4fc00f2f72879b",
         "type": "github"
       },
       "original": {
@@ -122,11 +122,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1739067033,
-        "narHash": "sha256-On2apbig9LjjSJDDzyCUZkxdWoQIBOavaG02vh693PQ=",
+        "lastModified": 1739121105,
+        "narHash": "sha256-Kn9uuOouk9Xtb+1FZNTbDGaomEsKZNG3IA/w61N7b8o=",
         "owner": "nix-community",
         "repo": "emacs-overlay",
-        "rev": "6c02db1d65ff3c8d1a871c50bd2cdf3b4822fafd",
+        "rev": "3e35634650753a5644cf07148cf49df1f023efce",
         "type": "github"
       },
       "original": {
@@ -543,11 +543,11 @@
     "lix": {
       "flake": false,
       "locked": {
-        "lastModified": 1739022633,
-        "narHash": "sha256-CaXRW9kDAcf1QIxjOF5ffMW0JkZWSrNv0QGBvd26EkY=",
+        "lastModified": 1739035579,
+        "narHash": "sha256-Zc7KAA3iC5Ak9reV/peqELKXJn6rLcSZptq1Tzcx9Nc=",
         "ref": "refs/heads/main",
-        "rev": "b60314f32eb02417463392b6276d456ad853ccc5",
-        "revCount": 17381,
+        "rev": "132d11c2d85425b7d23785ec306acb9b1d1ddba6",
+        "revCount": 17397,
         "type": "git",
         "url": "https://git@git.lix.systems/lix-project/lix"
       },
diff --git a/hosts/picard/default.nix b/hosts/picard/default.nix
index 104a454..9c2f4a1 100644
--- a/hosts/picard/default.nix
+++ b/hosts/picard/default.nix
@@ -41,6 +41,7 @@
       "adb"
       "prometheus-exporters"
       "promtail"
+      "dump1090"
     ]
     ++ [ ./disko.nix ];
 
diff --git a/modules/dump1090/default.nix b/modules/dump1090/default.nix
new file mode 100644
index 0000000..d6f2456
--- /dev/null
+++ b/modules/dump1090/default.nix
@@ -0,0 +1,45 @@
+{ pkgs, lib, ... }:
+{
+  systemd.services.dump1090-fa = {
+    description = "dump1090 ADS-B receiver (FlightAware customization)";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      DynamicUser = true;
+      SupplementaryGroups = "plugdev";
+      ExecStart = lib.escapeShellArgs [
+        (lib.getExe pkgs.dump1090)
+        "--net"
+        "--write-json"
+        "%t/dump1090-fa"
+      ];
+      RuntimeDirectory = "dump1090-fa";
+      WorkingDirectory = "%t/dump1090-fa";
+      RuntimeDirectoryMode = 755;
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts."dump1090-fa" = {
+      listen = [
+        {
+          addr = "0.0.0.0";
+          port = 8080;
+        }
+      ];
+      locations = {
+        "/".alias = "${pkgs.dump1090}/share/dump1090/";
+        "/data/".alias = "/run/dump1090-fa/";
+      };
+    };
+  };
+
+  # TODO before upstreaming in nixpkgs
+  # - add `meta.mainProgram` to dump1090
+  # - rename dump1090 to dump1090-fa
+  # - optionally create an alias for dump1090
+  # - securing the systemd service (`systemd-analyze security dump1090-fa`)
+}