diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index aaff787d6c4a..a4c63fcbc368 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -674,6 +674,7 @@ in
   gobgpd = runTest ./gobgpd.nix;
   gocd-agent = runTest ./gocd-agent.nix;
   gocd-server = runTest ./gocd-server.nix;
+  gocryptfs = runTest ./gocryptfs.nix;
   gokapi = runTest ./gokapi.nix;
   gollum = runTest ./gollum.nix;
   gonic = runTest ./gonic.nix;
diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix
new file mode 100644
index 000000000000..7474bdd56f23
--- /dev/null
+++ b/nixos/tests/gocryptfs.nix
@@ -0,0 +1,57 @@
+{
+  name = "gocryptfs";
+  meta = {
+    maintainers = [ ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+
+      environment.systemPackages = [
+        pkgs.gocryptfs
+        pkgs.openssl
+      ];
+
+      specialisation.fstab-test.configuration = {
+        fileSystems."/plain" = {
+          device = "/encrypted";
+          fsType = "fuse.gocryptfs";
+          options = [
+            "nofail"
+            "allow_other"
+            "passfile=/tmp/password.txt"
+          ];
+        };
+      };
+    };
+
+  testScript = ''
+
+    # Generate a password
+    machine.execute("openssl rand -base64 32 > /tmp/password.txt")
+
+    # Initialize an encrypted vault
+    machine.execute("mkdir -p /encrypted /plain")
+    machine.execute("gocryptfs -init /encrypted  -passfile /password.txt -quiet")
+
+    # Open and mount vault
+    machine.execute("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
+
+    machine.execute("echo test > /plain/data.txt")
+    machine.execute("echo test > /tmp/data.txt")
+
+    # Unmount
+    machine.execute("fusermount -u /plain")
+
+    # Switch to the specialisation
+    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration test")
+
+    # Wait for mount
+    machine.wait_for_unit("local-fs.target")
+
+    # Check data
+    machine.succeed("diff /plain/data.txt /tmp/data.txt")
+
+  '';
+}