diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index b74a35f1e9f..e369505fbc3 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -37,6 +37,7 @@ let
       ssl_ciphers ${cfg.sslCiphers};
       ssl_ecdh_curve secp521r1;
       ssl_prefer_server_ciphers on;
+      ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
 
       ssl_stapling on;
       ssl_stapling_verify on;
@@ -204,6 +205,13 @@ in
         description = "Allowed TLS protocol versions.";
       };
 
+      sslDhparam = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = literalExample "/path/to/dhparams.pem";
+        description = "Path to DH parameters file.";
+      };
+
       virtualHosts = mkOption {
         type = types.attrsOf (types.submodule (import ./vhost-options.nix {
           inherit lib;