diff --git a/CHANGELOG.md b/CHANGELOG.md
index 958338889..7673fd008 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -170,6 +170,7 @@ the ACME DNS-01 challenge through a built-in DNS provider: `acmedns`,
 ### Changes
 
 - A SIGHUP now reloads the certificate from `tls.cert_path` and `tls.key_path` without a restart; a certificate that cannot be loaded or is not valid now is logged as an error and the previous one keeps serving [#3027](https://github.com/juanfont/headscale/issues/3027)
+- The NixOS module's `headscale` service now supports `systemctl reload`
 - PostgreSQL connection settings are assembled into a `postgres://` URL with proper escaping, so a password (or host, user, database name) containing spaces, quotes or other reserved characters no longer truncates the DSN [#3477](https://github.com/juanfont/headscale/pull/3477)
 - Expiring or deleting a non-existent pre-auth key now returns an error instead of silently succeeding [#3324](https://github.com/juanfont/headscale/pull/3324)
 - Improve systemd service file hardening [#3341](https://github.com/juanfont/headscale/pull/3341)
diff --git a/nix/module.nix b/nix/module.nix
index 0407c7655..3a516a4c7 100644
--- a/nix/module.nix
+++ b/nix/module.nix
@@ -822,6 +822,7 @@ in
           capabilityBoundingSet = [ "CAP_CHOWN" ] ++ lib.optional (cfg.port < 1024) "CAP_NET_BIND_SERVICE";
         in
         {
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
           Restart = "always";
           RestartSec = "5s";
           Type = "simple";
diff --git a/nix/tests/headscale.nix b/nix/tests/headscale.nix
index 700ff524d..fb9a59674 100644
--- a/nix/tests/headscale.nix
+++ b/nix/tests/headscale.nix
@@ -70,6 +70,10 @@ in
 
     headscale.succeed("headscale policy set -f ${policy}")
 
+    # The docs tell operators to run this; it needs ExecReload in the unit.
+    headscale.succeed("systemctl reload headscale.service")
+    headscale.wait_until_succeeds("journalctl -u headscale.service --grep 'Received SIGHUP'")
+
     # Clients reconnect after a control restart, peer1 over the TLS listener.
     headscale.systemctl("restart headscale.service")
     headscale.wait_until_succeeds(