diff --git a/system/shared/boot/default.nix b/system/shared/boot/default.nix
index d6a59b9..7c9f5cd 100644
--- a/system/shared/boot/default.nix
+++ b/system/shared/boot/default.nix
@@ -4,6 +4,7 @@ _: {
     ./generic.nix
     ./secure-boot.nix
     ./initrd.nix
+    ./numlock.nix
     ./plymouth.nix
   ];
 }
diff --git a/system/shared/boot/numlock.nix b/system/shared/boot/numlock.nix
new file mode 100644
index 0000000..64bb6e7
--- /dev/null
+++ b/system/shared/boot/numlock.nix
@@ -0,0 +1,32 @@
+{ pkgs, ... }: {
+  boot.initrd.systemd = {
+    # Include setleds binary in the initrd
+    # (the nix store doesn't exists in there yet, so we need to include
+    # all of the necessary binaries ahead of time here)
+    extraBin = {
+      setleds = "${pkgs.kbd}/bin/setleds";
+    };
+
+    # Enable numlock in the early userspace (initrd)
+    # This will happen before we're asked for the disk decryption password
+    services."numlock" = {
+      enable = true;
+      description = "Activate Numlock";
+      wantedBy = [ "initrd.target" ];
+      # Delay disk decryption until this unit is started
+      before = [ "systemd-cryptsetup@cryptfs.service" ];
+      unitConfig.DefaultDependencies = "no";
+      serviceConfig.Type = "oneshot";
+      # This is essentially runs the same code as present in the 
+      # mkinitcpio-numlock hook on Arch Linux (AUR).
+      script = ''
+        #!/bin/bash
+
+        for tty in /dev/tty{1..6}
+        do
+            /bin/setleds -D +num < "$tty";
+        done
+      '';
+    };
+  };
+}