diff --git a/machines/modules/malobeo/wireguard.nix b/machines/modules/malobeo/wireguard.nix
index 36fde4f..81f4bb3 100644
--- a/machines/modules/malobeo/wireguard.nix
+++ b/machines/modules/malobeo/wireguard.nix
@@ -30,6 +30,12 @@ in
         description = lib.mdDoc "Setup wireguard to access malobeo maintainance vpn";
       };
 
+      autostart = mkOption {
+        default = true;
+        type = types.bool;
+        description = lib.mdDoc "whether to autostart vpn interface on boot";
+      };
+
       name = mkOption {
         default = "";
         type = types.str;
@@ -62,6 +68,7 @@ in
       interfaces = {
         malovpn = {
           address = myPeer.address;
+          autostart = cfg.autostart;
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;
 
           # This allows the wireguard server to route your traffic to the internet and hence be like a VPN