diff --git a/nixos/modules/services/networking/dhcpcd.nix b/nixos/modules/services/networking/dhcpcd.nix
index 7d50c9477bd5..0c69caa64bba 100644
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@@ -214,6 +214,12 @@ in
           };
       };
 
+    users.users._dhcpcd = {
+      isSystemUser = true;
+      group = "_dhcpcd";
+    };
+    users.groups._dhcpcd = {};
+
     environment.systemPackages = [ dhcpcd ];
 
     environment.etc."dhcpcd.exit-hook".source = exitHook;
diff --git a/pkgs/tools/networking/dhcpcd/default.nix b/pkgs/tools/networking/dhcpcd/default.nix
index 8927e8e76aa0..2f27956a7973 100644
--- a/pkgs/tools/networking/dhcpcd/default.nix
+++ b/pkgs/tools/networking/dhcpcd/default.nix
@@ -6,6 +6,7 @@
 , runtimeShellPackage
 , runtimeShell
 , nixosTests
+, enablePrivSep ? true
 }:
 
 stdenv.mkDerivation rec {
@@ -32,6 +33,12 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var"
+  ]
+  ++ lib.optionals enablePrivSep [
+    "--enable-privsep"
+    # dhcpcd disables privsep if it can't find the default user,
+    # so we explicitly specify the default.
+    "--privsepuser=_dhcpcd"
   ];
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];