diff --git a/modules/base.nix b/modules/base.nix
index 94ad855..5376427 100644
--- a/modules/base.nix
+++ b/modules/base.nix
@@ -113,6 +113,7 @@ in
       };
     };
   };
+  imports = [ ./early ];
   config = {
     defaultProfile.packages = with pkgs; [
       s6
diff --git a/modules/early/default.nix b/modules/early/default.nix
new file mode 100644
index 0000000..a72449e
--- /dev/null
+++ b/modules/early/default.nix
@@ -0,0 +1,37 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) mkOption types;
+  inherit (pkgs.pseudofile) dir symlink;
+in
+{
+  options = {
+    early = with types; {
+      sysctl = mkOption {
+        type = attrsOf anything;
+        description = "sysctl definitions to set at early boot";
+        example = {
+          vm.overcommit_memory = 0;
+          user.max_cgroup_namespaces = 62933;
+          net.ipv6.route.gc_timeout = 60;
+        };
+      };
+    };
+  };
+  config.filesystem = dir {
+    etc =
+      let
+        sysctls = pkgs.writeAshScript "sysctls" { } ''
+          cd /proc/sys
+          ${pkgs.liminix.writeSysctls config.early.sysctl}
+        '';
+      in
+      dir {
+        "sysctl.sh" = symlink sysctls;
+      };
+  };
+}
diff --git a/modules/s6/scripts/rc.init b/modules/s6/scripts/rc.init
index 1c1b031..b89de53 100755
--- a/modules/s6/scripts/rc.init
+++ b/modules/s6/scripts/rc.init
@@ -27,6 +27,8 @@ if test -c /dev/pmsg0 ; then
     (cat /sys/fs/pstore/* && rm  /sys/fs/pstore/*) > /run/log/previous-boot
 fi
 
+/etc/sysctl.sh
+
 mkdir -m 0751 -p /run/services/outputs
 chgrp system /run/services/outputs
 
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 283565d..d88a396 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -22,6 +22,18 @@ in
       uimage = callPackage ./kernel/uimage.nix { };
       kernel = callPackage ./kernel { };
     };
+    writeSysctls =
+      let
+        inherit (lib) concatStringsSep collect mapAttrsRecursive;
+      in
+      s:
+      concatStringsSep "\n" (
+        collect (x: !builtins.isAttrs x) (
+          mapAttrsRecursive (
+            p: v: "echo ${builtins.toJSON (builtins.toString v)} > ${concatStringsSep "/" p}"
+          ) s
+        )
+      );
     outputRef =
       service: path:
       let