diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index 75ce9e26a30f..b74a35f1e9f5 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -34,7 +34,7 @@ let
       ssl_session_cache shared:SSL:42m;
       ssl_session_timeout 23m;
 
-      ssl_ciphers EDH+aRSA+AES256:+AESGCM:ECDHE+aRSA+AES256;
+      ssl_ciphers ${cfg.sslCiphers};
       ssl_ecdh_curve secp521r1;
       ssl_prefer_server_ciphers on;
 
@@ -191,6 +191,12 @@ in
         description = "Show nginx version in headers and error pages";
       };
 
+      sslCiphers = mkOption {
+        type = types.str;
+        default = "EDH+CHACHA20:EDH+AES:EECDHE+CHACHA20:ECDHE+AES:+AES128:-DSS";
+        description = "Ciphers to choose from when negotiating tls handshakes.";
+      };
+
       sslProtocols = mkOption {
         type = types.str;
         default = "TLSv1.2";