diff --git a/modules/programs/glab.nix b/modules/programs/glab.nix
new file mode 100644
index 000000000..5b536f308
--- /dev/null
+++ b/modules/programs/glab.nix
@@ -0,0 +1,64 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.programs.glab;
+  yamlFormat = pkgs.formats.yaml { };
+
+in {
+  meta.maintainers = [ maintainers.shikanime ];
+
+  options.programs.glab = {
+    enable = mkEnableOption "GitLab CLI";
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.glab;
+      defaultText = literalExpression "pkgs.glab";
+      description = "Package providing {command}`glab`.";
+    };
+
+    settings = mkOption {
+      type = yamlFormat.type;
+      default = { };
+      description =
+        "Configuration written to {file}`$XDG_CONFIG_HOME/glab-cli/config.yml`.";
+      example = literalExpression ''
+        {
+          git_protocol = "ssh";
+        };
+      '';
+    };
+
+    gitCredentialHelper = {
+      enable = mkEnableOption "the glab git credential helper" // {
+        default = true;
+      };
+
+      hosts = mkOption {
+        type = types.listOf types.str;
+        default = [ "https://gitlab.com" ];
+        description =
+          "GitLab hosts to enable the glab git credential helper for";
+        example = literalExpression ''
+          ["https://gitlab.com"]
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    home.packages = [ cfg.package ];
+
+    xdg.configFile."glab-cli/config.yml".source =
+      yamlFormat.generate "glab-cli-config.yml" cfg.settings;
+
+    programs.git.extraConfig.credential = mkIf cfg.gitCredentialHelper.enable
+      (builtins.listToAttrs (map (host:
+        lib.nameValuePair host {
+          helper = "${cfg.package}/bin/glab auth git-credential";
+        }) cfg.gitCredentialHelper.hosts));
+  };
+}
diff --git a/tests/modules/programs/glab/config-file.nix b/tests/modules/programs/glab/config-file.nix
new file mode 100644
index 000000000..ca99ec394
--- /dev/null
+++ b/tests/modules/programs/glab/config-file.nix
@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+
+{
+  config = {
+    programs.glab = {
+      enable = true;
+      settings.git_protocol = "ssh";
+      settings.editor = "vim";
+    };
+
+    test.stubs.glab = { };
+
+    nmt.script = ''
+      assertFileExists home-files/.config/glab-cli/config.yml
+      assertFileContent home-files/.config/glab-cli/config.yml ${
+        builtins.toFile "config-file.yml" ''
+          git_protocol: ssh
+          editor: vim
+        ''
+      }
+    '';
+  };
+}
diff --git a/tests/modules/programs/glab/credential-helper.git.conf b/tests/modules/programs/glab/credential-helper.git.conf
new file mode 100644
index 000000000..e449480cc
--- /dev/null
+++ b/tests/modules/programs/glab/credential-helper.git.conf
@@ -0,0 +1,5 @@
+[credential "https://gitlab.com"]
+	helper = "@glab@/bin/glab auth git-credential"
+
+[credential "https://gitlab.example.com"]
+	helper = "@glab@/bin/glab auth git-credential"
diff --git a/tests/modules/programs/glab/credential-helper.nix b/tests/modules/programs/glab/credential-helper.nix
new file mode 100644
index 000000000..4059c28d2
--- /dev/null
+++ b/tests/modules/programs/glab/credential-helper.nix
@@ -0,0 +1,21 @@
+{ config, lib, pkgs, ... }:
+
+{
+  programs.glab = {
+    enable = true;
+    gitCredentialHelper = {
+      enable = true;
+      hosts = [ "https://gitlab.com" "https://gitlab.example.com" ];
+    };
+  };
+
+  programs.git.enable = true;
+
+  test.stubs.glab = { };
+
+  nmt.script = ''
+    assertFileExists home-files/.config/git/config
+    assertFileContent home-files/.config/git/config \
+      ${./credential-helper.git.conf}
+  '';
+}
diff --git a/tests/modules/programs/glab/default.nix b/tests/modules/programs/glab/default.nix
new file mode 100644
index 000000000..63c9e2baa
--- /dev/null
+++ b/tests/modules/programs/glab/default.nix
@@ -0,0 +1,4 @@
+{
+  glab-config-file = ./config-file.nix;
+  glab-credential-helper = ./credential-helper.nix;
+}