diff --git a/modules/ntpsec.lua b/modules/ntpsec.lua
new file mode 100644
index 0000000..833322b
--- /dev/null
+++ b/modules/ntpsec.lua
@@ -0,0 +1,42 @@
+add_packages({ "ntpsec" })
+
+-- In the ntpsec-doc package, open in browser:
+-- file:///usr/share/doc/ntpsec/quick.html
+-- file:///usr/share/doc/ntpsec/NTS-QuickStart.html
+
+add_file("/etc/ntp.conf", [[
+driftfile /var/lib/ntp/ntp.drift
+
+restrict default kod limited nomodify nopeer noquery
+restrict 127.0.0.1
+restrict ::1
+
+# https://gist.github.com/jauderho/2ad0d441760fc5ed69d8d4e2d6b35f8d
+
+server time.cloudflare.com nts iburst
+server nts.ntp.se nts iburst
+
+# https://nts.time.nl/
+server ntppool1.time.nl nts iburst
+server ntppool2.time.nl nts iburst
+
+# https://system76.com/time/
+server paris.time.system76.com nts iburst
+server brazil.time.system76.com nts iburst
+
+# https://www.netnod.se/netnod-time/how-to-use-nts
+server sth1.nts.netnod.se nts iburst
+server sth2.nts.netnod.se nts iburst
+
+# https://ntp.br/guia/linux/
+server a.st1.ntp.br nts iburst
+server b.st1.ntp.br nts iburst
+server c.st1.ntp.br nts iburst
+server d.st1.ntp.br nts iburst
+server gps.ntp.br nts iburst
+
+]])
+
+modules.runit.add_service("ntpsec", [[#!/bin/sh
+exec ntpd --nice --nofork --panicgate
+]])
diff --git a/setup.lua b/setup.lua
index 4da73cf..77823c2 100644
--- a/setup.lua
+++ b/setup.lua
@@ -47,6 +47,7 @@ module "runit"
 module "socklog"
 module "hostname"
 module "dhcpcd"
+module "ntpsec"
 module "nginx"
 
 print("=> Installing and upgrading packages...")