diff --git a/nixos/modules/services/networking/anubis.nix b/nixos/modules/services/networking/anubis.nix
index d44619446b7c..968595d303d1 100644
--- a/nixos/modules/services/networking/anubis.nix
+++ b/nixos/modules/services/networking/anubis.nix
@@ -55,7 +55,7 @@ let
           type = types.str;
         };
 
-        botPolicy = lib.mkOption {
+        botPolicy = mkDefaultOption "botPolicy" {
           default = null;
           description = ''
             Anubis policy configuration in Nix syntax. Set to `null` to use the baked-in policy which should be
@@ -265,7 +265,18 @@ in
         wants = [ "network-online.target" ];
 
         environment = lib.mapAttrs (lib.const (lib.generators.mkValueStringDefault { })) (
-          lib.filterAttrs (_: v: v != null) instance.settings
+          lib.filterAttrs (_: v: v != null) (
+            instance.settings
+            // {
+              POLICY_FNAME =
+                if instance.settings.POLICY_FNAME != null then
+                  instance.settings.POLICY_FNAME
+                else if instance.botPolicy != null then
+                  jsonFormat.generate "${instanceName name}-botPolicy.json" instance.botPolicy
+                else
+                  null;
+            }
+          )
         );
 
         serviceConfig = {
diff --git a/nixos/tests/anubis.nix b/nixos/tests/anubis.nix
index 973c1b3f369f..761c31d6b8c6 100644
--- a/nixos/tests/anubis.nix
+++ b/nixos/tests/anubis.nix
@@ -11,9 +11,13 @@
     { config, pkgs, ... }:
     {
       services.anubis = {
-        defaultOptions.settings = {
-          DIFFICULTY = 3;
-          USER_DEFINED_DEFAULT = true;
+        defaultOptions = {
+          # Get default botPolicy
+          botPolicy = lib.importJSON "${config.services.anubis.package.src}/data/botPolicies.json";
+          settings = {
+            DIFFICULTY = 3;
+            USER_DEFINED_DEFAULT = true;
+          };
         };
         instances = {
           "".settings = {
@@ -38,11 +42,34 @@
             group = "nginx";
             settings.TARGET = "unix:///run/nginx/nginx.sock";
           };
+
+          "botPolicy-default" = {
+            botPolicy = null;
+            settings.TARGET = "http://localhost:8080";
+          };
+
+          "botPolicy-file" = {
+            settings = {
+              TARGET = "http://localhost:8080";
+              POLICY_FNAME = "/etc/anubis-botPolicy.json";
+            };
+          };
         };
       };
 
+      # Empty json for testing
+      environment.etc."anubis-botPolicy.json".text = lib.generators.toJSON { } {
+        bots = [
+          {
+            name = "allow-all";
+            user_agent_regex = ".*";
+            action = "ALLOW";
+          }
+        ];
+      };
+
       # support
-      users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
+      users.users.nginx.extraGroups = [ config.services.anubis.defaultOptions.group ];
       services.nginx = {
         enable = true;
         recommendedProxySettings = true;
@@ -115,5 +142,10 @@
     # Make sure defaults don't overwrite themselves
     machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "DIFFICULTY=5"')
     machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "DIFFICULTY=3"')
+
+    # Check correct BotPolicy settings are applied
+    machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "POLICY_FNAME=/nix/store"')
+    machine.fail('cat /run/current-system/etc/systemd/system/anubis-botPolicy-default.service | grep "POLICY_FNAME="')
+    machine.succeed('cat /run/current-system/etc/systemd/system/anubis-botPolicy-file.service | grep "POLICY_FNAME=/etc/anubis-botPolicy.json"')
   '';
 }