diff --git a/wireguard/astrid@banana.pub b/wireguard/astrid@banana.pub
new file mode 100644
index 00000000..aac033dd
--- /dev/null
+++ b/wireguard/astrid@banana.pub
@@ -0,0 +1 @@
+VbaDq7X13wt0MSRGBk6OYkd9lRUSrhGDhEJJbQrzk1M=
diff --git a/wireguard/enroll.sh b/wireguard/enroll.sh
new file mode 100755
index 00000000..c5a5dcb4
--- /dev/null
+++ b/wireguard/enroll.sh
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+hostname=$(hostname)
+username=$(whoami)
+filename="$username@$hostname"
+dstdir="$HOME/.config/nyahaus-wireguard/"
+private_key="$dstdir/private.key"
+
+umask 077
+mkdir -p "$dstdir"
+chmod 700 "$dstdir"
+
+echo "writing private key to $private_key"
+wg genkey > "$private_key"
+chmod 600 "$private_key"
+
+echo "writing public key to $filename.pub"
+umask 777
+cat "$private_key" | wg pubkey | tee "$filename.pub"
+