diff --git a/nixos/modules/services/networking/kresd.nix b/nixos/modules/services/networking/kresd.nix
index c93b591701a7..40440fbd16cc 100644
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@@ -68,8 +68,7 @@ in
       description = ''
         Whether to enable knot-resolver domain name server.
         DNSSEC validation is turned on by default.
-        You can run `sudo nc -U /run/knot-resolver/control/1`
-        and give commands interactively to kresd@1.service.
+        You can run `kresd-cli 1` and give commands interactively to kresd@1.service.
       '';
     };
     package = lib.mkPackageOption pkgs "knot-resolver" {
@@ -135,7 +134,25 @@ in
 
   ###### implementation
   config = lib.mkIf cfg.enable {
-    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required
+    environment = {
+      etc."knot-resolver/kresd.conf".source = configFile; # not required
+      systemPackages = [
+        (pkgs.writeShellScriptBin "kresd-cli" ''
+          if [[ ''${1:-} == -h || ''${1:-} == --help ]]; then
+            echo "Usage: $0 [X]"
+            echo
+            echo "  X is number of the control socket and corresponds to the number of the template unit."
+            exit
+          fi
+
+          exec=exec
+          if [[ "$USER" != knot-resolver ]]; then
+            exec='exec /run/wrappers/bin/sudo -u knot-resolver'
+          fi
+          $exec ${lib.getExe pkgs.socat} - /run/knot-resolver/control/''${1:-1}
+        '')
+      ];
+    };
 
     networking.resolvconf.useLocalResolver = lib.mkDefault true;