diff --git a/nixosModules/clanCore/vars/eval-tests/default.nix b/nixosModules/clanCore/vars/eval-tests/default.nix
index b4dfd304..b9713915 100644
--- a/nixosModules/clanCore/vars/eval-tests/default.nix
+++ b/nixosModules/clanCore/vars/eval-tests/default.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 let
   eval =
     module:
@@ -7,6 +7,7 @@ let
         ../interface.nix
         module
       ];
+      specialArgs.pkgs = pkgs;
     }).config;
 
   usage_simple = {
@@ -64,7 +65,43 @@ in
       config = eval { generators.imports = [ generator_module ]; };
     in
     {
-      expr = lib.trace (lib.attrNames config.generators) config.generators ? my-generator;
+      expr = config.generators ? my-generator;
+      expected = true;
+    };
+
+  # script can be text
+  test_script_text =
+    let
+      config = eval {
+        # imports = [ usage_simple ];
+        generators.my_secret.script = ''
+          echo "Hello, world!"
+        '';
+      };
+    in
+    {
+      expr = config.generators.my_secret.script;
+      expected = "echo \"Hello, world!\"\n";
+    };
+
+  # script can be a derivation
+  test_script_writer =
+    let
+      config = eval {
+        # imports = [ usage_simple ];
+        generators.my_secret.script = derivation {
+          system = pkgs.system;
+          name = "my-script";
+          builder = "/bin/sh";
+          args = [
+            "-c"
+            ''touch $out''
+          ];
+        };
+      };
+    in
+    {
+      expr = lib.hasPrefix builtins.storeDir config.generators.my_secret.script;
       expected = true;
     };
 }
diff --git a/nixosModules/clanCore/vars/flake-module.nix b/nixosModules/clanCore/vars/flake-module.nix
index 77830ad3..3be63eeb 100644
--- a/nixosModules/clanCore/vars/flake-module.nix
+++ b/nixosModules/clanCore/vars/flake-module.nix
@@ -16,6 +16,7 @@ in
       legacyPackages.evalTests-module-clan-vars = import ./eval-tests {
         inherit lib;
         clan-core = self;
+        pkgs = inputs.nixpkgs.legacyPackages.${system};
       };
       checks.module-clan-vars-eval = pkgs.runCommand "tests" { nativeBuildInputs = [ pkgs.nix-unit ]; } ''
         export HOME="$(realpath .)"
diff --git a/nixosModules/clanCore/vars/generator.nix b/nixosModules/clanCore/vars/generator.nix
new file mode 100644
index 00000000..3e1142bf
--- /dev/null
+++ b/nixosModules/clanCore/vars/generator.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+{
+  finalScript = lib.mkOptionDefault ''
+    set -eu -o pipefail
+
+    export PATH="${lib.makeBinPath config.path}:${pkgs.coreutils}/bin"
+
+    ${lib.optionalString (pkgs.stdenv.hostPlatform.isLinux) ''
+      # prepare sandbox user on platforms where this is supported
+      mkdir -p /etc
+
+      cat > /etc/group <<EOF
+      root:x:0:
+      nixbld:!:$(id -g):
+      nogroup:x:65534:
+      EOF
+
+      cat > /etc/passwd <<EOF
+      root:x:0:0:Nix build user:/build:/noshell
+      nixbld:x:$(id -u):$(id -g):Nix build user:/build:/noshell
+      nobody:x:65534:65534:Nobody:/:/noshell
+      EOF
+
+      cat > /etc/hosts <<EOF
+      127.0.0.1 localhost
+      ::1 localhost
+      EOF
+    ''}
+    ${config.script}
+  '';
+}
diff --git a/nixosModules/clanCore/vars/interface.nix b/nixosModules/clanCore/vars/interface.nix
index 15f1a501..0f596919 100644
--- a/nixosModules/clanCore/vars/interface.nix
+++ b/nixosModules/clanCore/vars/interface.nix
@@ -5,8 +5,10 @@ let
     anything
     attrsOf
     bool
+    either
     enum
     listOf
+    path
     str
     submoduleWith
     ;
@@ -26,6 +28,12 @@ in
       };
     };
     generators = {
+      default = {
+        imports = [
+          # default implementation of the generator
+          ./generator.nix
+        ];
+      };
       type = submodule {
         freeformType = attrsOf (subOptions {
           dependencies = {
@@ -109,7 +117,17 @@ in
                 - $prompts: The directory containing the prompted values as files
               The script should produce the files specified in the 'files' attribute under $out.
             '';
-            type = str;
+            type = either str path;
+          };
+          finalScript = {
+            description = ''
+              The final generator script, wrapped, so:
+                - all required programs are in PATH
+                - sandbox is set up correctly
+            '';
+            type = lib.types.str;
+            readOnly = true;
+            internal = true;
           };
         });
       };