diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix
index 2b221ab..3ab557d 100644
--- a/configurations/nixos/defiant/configuration.nix
+++ b/configurations/nixos/defiant/configuration.nix
@@ -280,6 +280,12 @@
       subdomain = "home";
       openFirewall = true;
       database = "postgres";
+
+      extensions = {
+        sonos.enable = true;
+        jellyfin.enable = true;
+        wyoming.enable = true;
+      };
     };
 
     qbittorrent = {
diff --git a/modules/nixos-modules/server/default.nix b/modules/nixos-modules/server/default.nix
index 5f63925..00e506d 100644
--- a/modules/nixos-modules/server/default.nix
+++ b/modules/nixos-modules/server/default.nix
@@ -9,6 +9,7 @@
     ./forgejo.nix
     ./searx.nix
     ./home-assistant.nix
+    ./wyoming.nix
     ./immich.nix
     ./qbittorent.nix
   ];
diff --git a/modules/nixos-modules/server/home-assistant.nix b/modules/nixos-modules/server/home-assistant.nix
index 7497995..6eb5682 100644
--- a/modules/nixos-modules/server/home-assistant.nix
+++ b/modules/nixos-modules/server/home-assistant.nix
@@ -21,6 +21,23 @@ in {
       description = "what database do we want to use";
       default = "builtin";
     };
+
+    extensions = {
+      sonos = {
+        enable = lib.mkEnableOption "enable the sonos plugin";
+        port = lib.mkOption {
+          type = lib.types.int;
+          default = 1400;
+          description = "what port to use for sonos discovery";
+        };
+      };
+      jellyfin = {
+        enable = lib.mkEnableOption "enable the jellyfin plugin";
+      };
+      wyoming = {
+        enable = lib.mkEnableOption "enable wyoming";
+      };
+    };
   };
 
   config = lib.mkIf config.services.home-assistant.enable (lib.mkMerge [
@@ -50,11 +67,9 @@ in {
           "radio_browser"
           "isal"
           "zha"
-          "jellyfin"
           "webostv"
           "tailscale"
           "syncthing"
-          "sonos"
           "analytics_insights"
           "unifi"
           "openweathermap"
@@ -80,10 +95,26 @@ in {
           ];
       };
 
+      # TODO: configure /var/lib/hass/secrets.yaml via sops
+
       systemd.tmpfiles.rules = [
         "f ${config.services.home-assistant.configDir}/automations.yaml 0755 hass hass"
       ];
     }
+    (lib.mkIf (config.services.home-assistant.extensions.sonos.enable) {
+      services.home-assistant.extraComponents = ["sonos"];
+      networking.firewall.allowedTCPPorts = [
+        config.services.home-assistant.extensions.sonos.port
+      ];
+    })
+    (lib.mkIf (config.services.home-assistant.extensions.jellyfin.enable) {
+      services.home-assistant.extraComponents = ["jellyfin"];
+      # TODO: configure port, address, and login information here
+    })
+    (lib.mkIf (config.services.home-assistant.extensions.wyoming.enable) {
+      services.home-assistant.extraComponents = ["wyoming"];
+      services.wyoming.enable = true;
+    })
     (lib.mkIf (config.services.home-assistant.database == "postgres") {
       host = {
         postgres = {
diff --git a/modules/nixos-modules/server/wyoming.nix b/modules/nixos-modules/server/wyoming.nix
new file mode 100644
index 0000000..4894dd4
--- /dev/null
+++ b/modules/nixos-modules/server/wyoming.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  config,
+  ...
+}: {
+  options.services.wyoming.enable = lib.mkEnableOption "should wyoming be enabled on this device";
+  config = lib.mkIf config.services.wyoming.enable (lib.mkMerge [
+    {
+      services.wyoming = {
+        # Text to speech
+        piper = {
+          servers = {
+            "en" = {
+              enable = true;
+              # see https://github.com/rhasspy/rhasspy3/blob/master/programs/tts/piper/script/download.py
+              voice = "en-us-amy-low";
+              uri = "tcp://0.0.0.0:10200";
+              speaker = 0;
+            };
+          };
+        };
+
+        # Speech to text
+        faster-whisper = {
+          servers = {
+            "en" = {
+              enable = true;
+              # see https://github.com/rhasspy/rhasspy3/blob/master/programs/asr/faster-whisper/script/download.py
+              model = "tiny-int8";
+              language = "en";
+              uri = "tcp://0.0.0.0:10300";
+              device = "cpu";
+            };
+          };
+        };
+
+        openwakeword = {
+          enable = true;
+          uri = "tcp://0.0.0.0:10400";
+          preloadModels = [
+            "ok_nabu"
+          ];
+          # TODO: custom models
+        };
+      };
+
+      # needs access to /proc/cpuinfo
+      systemd.services."wyoming-faster-whisper-en".serviceConfig.ProcSubset = lib.mkForce "all";
+    }
+    (lib.mkIf config.host.impermanence.enable {
+      environment.persistence."/persist/system/root" = {
+        enable = true;
+        hideMounts = true;
+        directories = [
+          {
+            directory = "/var/lib/private/wyoming";
+            mode = "0700";
+          }
+        ];
+      };
+    })
+  ]);
+}