diff --git a/buildbot_nix/__init__.py b/buildbot_nix/__init__.py
index 25a1b4f..4ddecaf 100644
--- a/buildbot_nix/__init__.py
+++ b/buildbot_nix/__init__.py
@@ -880,8 +880,10 @@ class GerritNixConfigurator(ConfiguratorBase):
         signing_keyfile: str | None = None,
         binary_cache_config: dict[str, str] | None = None,
         auth_method: AuthBase | None = None,
+        manhole: Any = None,
     ) -> None:
         super().__init__()
+        self.manhole = manhole
         self.allowed_origins = allowed_origins
         self.gerrit_server = gerrit_server
         self.gerrit_user = gerrit_user
@@ -915,6 +917,9 @@ class GerritNixConfigurator(ConfiguratorBase):
         worker_config = json.loads(read_secret_file(self.nix_workers_secret_name))
         worker_names = []
 
+        if self.manhole is not None:
+            config["manhole"] = self.manhole
+
         config.setdefault("projects", [])
         config.setdefault("secretsProviders", [])
         config.setdefault("www", {
diff --git a/nix/coordinator.nix b/nix/coordinator.nix
index e615a17..6ae8569 100644
--- a/nix/coordinator.nix
+++ b/nix/coordinator.nix
@@ -7,6 +7,9 @@
 let
   inherit (lib) filterAttrs;
   cfg = config.services.buildbot-nix.coordinator;
+  debuggingManhole = if cfg.debugging.enable then
+  "manhole.TelnetManhole(${toString cfg.debugging.port}, 'admin', 'admin')"
+  else "None";
 in
 {
   options = {
@@ -28,6 +31,14 @@ in
         description = "List of local remote builders machines associated to that Buildbot instance";
       };
 
+      debugging = {
+        enable = lib.mkEnableOption "manhole's buildbot debugging on localhost using `admin:admin`";
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 15000;
+        };
+      };
+
       oauth2 = {
         name = lib.mkOption {
           type = lib.types.str;
@@ -197,6 +208,7 @@ in
       extraImports = ''
         from datetime import timedelta
         from buildbot_nix import GerritNixConfigurator, read_secret_file, make_oauth2_method, OAuth2Config, assemble_secret_file_path
+        from buildbot import manhole
 
         # TODO(raito): make me configurable from the NixOS module.
         # how?
@@ -234,7 +246,8 @@ in
               auth_method=CustomOAuth2(${builtins.toJSON cfg.oauth2.clientId},
                 read_secret_file('buildbot-oauth2-secret'),
                 autologin=True
-              )
+              ),
+              manhole=${debuggingManhole}
           )
         ''
       ];