diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 3fbd21ee4f1d..3ec838a06844 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -14,6 +14,8 @@
 
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)
 
+- [tap](https://github.com/bluesky-social/indigo/tree/main/cmd/tap), an ATProtocol firehose synchronisation utility. Available as [services.tap](#opt-services.tap.enable).
+
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
 - [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 692b4462c928..622d7932aee5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1428,6 +1428,7 @@
   ./services/networking/tailscale-derper.nix
   ./services/networking/tailscale-serve.nix
   ./services/networking/tailscale.nix
+  ./services/networking/tap.nix
   ./services/networking/tayga.nix
   ./services/networking/tcpcrypt.nix
   ./services/networking/teamspeak3.nix
diff --git a/nixos/modules/services/networking/tap.nix b/nixos/modules/services/networking/tap.nix
new file mode 100644
index 000000000000..bea84531014d
--- /dev/null
+++ b/nixos/modules/services/networking/tap.nix
@@ -0,0 +1,131 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.tap;
+in
+{
+  options.services.tap = {
+    enable = lib.mkEnableOption "Tap, ATProtocol firehose sync utility";
+
+    package = lib.mkPackageOption pkgs "tap" { };
+
+    environmentFiles = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        Files to load environment variables from. Use for secrets such as
+        {env}`TAP_ADMIN_PASSWORD` that should not be readable in the Nix store.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Configuration for Tap as environment variables. See the
+        [README](https://github.com/bluesky-social/indigo/blob/main/cmd/tap/README.md)
+        for all available options.
+
+        Secrets such as {option}`settings.TAP_ADMIN_PASSWORD` should be set via
+        {option}`environmentFiles` rather than here, as values set here will
+        be readable in the Nix store.
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.bool
+              lib.types.int
+              lib.types.float
+              lib.types.str
+            ]
+          )
+        );
+
+        options = {
+          TAP_BIND = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1:2480";
+            description = "Address and port the HTTP server will listen on.";
+          };
+
+          TAP_DATABASE_URL = lib.mkOption {
+            type = lib.types.str;
+            default = "sqlite:///var/lib/tap/tap.db";
+            description = ''
+              Database connection string. Accepts SQLite (`sqlite://path`) or
+              PostgreSQL (`postgres://...`) connection strings.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.tap = {
+      description = "Tap - ATProtocol firehose sync utility";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        User = "tap";
+        DynamicUser = true;
+
+        ExecStart = "${lib.getExe cfg.package} run";
+        Environment = lib.mapAttrsToList (
+          k: v: "${k}=${if lib.isBool v then lib.boolToString v else toString v}"
+        ) (lib.filterAttrs (_: v: v != null) cfg.settings);
+        EnvironmentFile = cfg.environmentFiles;
+
+        Restart = "on-failure";
+        RestartSec = 5;
+        StateDirectory = "tap";
+        StateDirectoryMode = "0750";
+
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        ProtectSystem = "strict";
+
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        RemoveIPC = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ blooym ];
+}
diff --git a/pkgs/by-name/ta/tap/package.nix b/pkgs/by-name/ta/tap/package.nix
new file mode 100644
index 000000000000..f272148d841e
--- /dev/null
+++ b/pkgs/by-name/ta/tap/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  buildGoModule,
+  nix-update-script,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "tap";
+  version = "0.1.10";
+
+  src = fetchFromGitHub {
+    owner = "bluesky-social";
+    repo = "indigo";
+    rev = "tap-v${finalAttrs.version}";
+    hash = "sha256-nDOLIRWTyj/R0h+70+bGi85RVe2OKLNbnSaKyyqc93Q=";
+  };
+
+  vendorHash = "sha256-s1S+b+QbptqJ2mxqkvsn7M5VWfLrlwpWgRjg6lq2WVE=";
+
+  subPackages = [
+    "cmd/tap"
+  ];
+
+  postPatch = ''
+    substituteInPlace cmd/tap/main.go \
+      --replace-fail "versioninfo.Short()" '"${finalAttrs.version}"' \
+      --replace-fail '"github.com/earthboundkid/versioninfo/v2"' ""
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "ATProtocol firehose sync utility";
+    homepage = "https://github.com/bluesky-social/indigo/tree/main/cmd/tap/README.md";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [
+      blooym
+    ];
+    mainProgram = "tap";
+  };
+})