diff --git a/hosts/dogma-wsl/default.nix b/hosts/dogma-wsl/default.nix
new file mode 100644
index 0000000..b19c617
--- /dev/null
+++ b/hosts/dogma-wsl/default.nix
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, ... }: {
+  imports = [
+    ../common/default.nix
+  ];
+
+  networking.hostName = "dogma-wsl";
+
+  # WSL-specific: no bootloader, no hardware-configuration.nix
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
+
+  # WSL uses nixos-wsl module injected via flake; ensure systemd is enabled
+  wsl.enable = true;
+  wsl.defaultUser = "mask";
+
+  # Headless - explicitly disable desktop/server features that may leak via common
+  # (common/default.nix is minimal, but ensure graphics/desktop stays off)
+  services.xserver.enable = lib.mkForce false;
+  programs.hyprland.enable = lib.mkForce false;
+  services.pipewire.enable = lib.mkForce false;
+  services.sunshine.enable = lib.mkForce false;
+  virtualisation.libvirtd.enable = lib.mkForce false;
+  virtualisation.docker.enable = lib.mkForce false;
+
+  # No bridged networking in WSL
+  networking.firewall.trustedInterfaces = lib.mkForce [];
+}