diff --git a/agent/agent.go b/agent/agent.go
index fb0a134..e81188f 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -99,18 +99,38 @@ const (
 	winExeName           = "tacticalrmm.exe"
 	winSvcName           = "tacticalrmm"
 	meshSvcName          = "mesh agent"
-	etcConfig            = "/etc/tacticalagent"
-	nixAgentDir          = "/opt/tacticalagent"
-	nixMeshDir           = "/opt/tacticalmesh"
-	nixAgentBin          = nixAgentDir + "/tacticalagent"
-	nixAgentBinDir       = nixAgentDir + "/bin"
-	nixAgentEtcDir       = nixAgentDir + "/etc"
-	nixMeshAgentBin      = nixMeshDir + "/meshagent"
 	macPlistPath         = "/Library/LaunchDaemons/tacticalagent.plist"
 	macPlistName         = "tacticalagent"
 	defaultMacMeshSvcDir = "/usr/local/mesh_services"
 )
 
+// Unix paths are prefixed with installPrefix so the agent can run on systems where /etc and /opt are read-only.
+// I.e. NixOS, TrueNAS Scale, diskless images.
+var (
+	installPrefix   = ""
+	etcConfig       = "/etc/tacticalagent"
+	nixAgentDir     = "/opt/tacticalagent"
+	nixMeshDir      = "/opt/tacticalmesh"
+	nixAgentBin     = nixAgentDir + "/tacticalagent"
+	nixAgentBinDir  = nixAgentDir + "/bin"
+	nixAgentEtcDir  = nixAgentDir + "/etc"
+	nixMeshAgentBin = nixMeshDir + "/meshagent"
+)
+
+// SetInstallPrefix relocates the Unix agent/config/mesh trees under a single
+// writable root. Must be called before Agent.New or any install/read path so
+// the derived paths observe the prefix.
+func SetInstallPrefix(prefix string) {
+	installPrefix = strings.TrimRight(prefix, "/")
+	etcConfig = installPrefix + "/etc/tacticalagent"
+	nixAgentDir = installPrefix + "/opt/tacticalagent"
+	nixMeshDir = installPrefix + "/opt/tacticalmesh"
+	nixAgentBin = nixAgentDir + "/tacticalagent"
+	nixAgentBinDir = nixAgentDir + "/bin"
+	nixAgentEtcDir = nixAgentDir + "/etc"
+	nixMeshAgentBin = nixMeshDir + "/meshagent"
+}
+
 var defaultWinTmpDir = filepath.Join(os.Getenv("PROGRAMDATA"), "TacticalRMM")
 var winMeshDir = filepath.Join(os.Getenv("PROGRAMFILES"), "Mesh Agent")
 var natsCheckin = []string{"agent-hello", "agent-agentinfo", "agent-disks", "agent-winsvc", "agent-publicip", "agent-wmi"}
diff --git a/agent/agent_unix.go b/agent/agent_unix.go
index b2ab201..34b0be6 100644
--- a/agent/agent_unix.go
+++ b/agent/agent_unix.go
@@ -141,6 +141,7 @@ func (a *Agent) osString() string {
 func NewAgentConfig() *rmm.AgentConfig {
 	viper.SetConfigName("tacticalagent")
 	viper.SetConfigType("json")
+	viper.AddConfigPath(filepath.Dir(etcConfig))
 	viper.AddConfigPath("/etc/")
 	viper.AddConfigPath(".")
 	err := viper.ReadInConfig()
diff --git a/main.go b/main.go
index 71cfcc3..a468217 100644
--- a/main.go
+++ b/main.go
@@ -56,8 +56,13 @@ func main() {
 	proxy := flag.String("proxy", "", "Use a http proxy")
 	insecure := flag.Bool("insecure", false, "Insecure for testing only")
 	natsport := flag.String("natsport", "", "nats standard port")
+	installPrefix := flag.String("install-prefix", os.Getenv("INSTALL_PREFIX"), "Unix install path prefix. Defaults to $INSTALL_PREFIX")
 	flag.Parse()
 
+	if *installPrefix != "" {
+		agent.SetInstallPrefix(*installPrefix)
+	}
+
 	if *ver {
 		agent.ShowVersionInfo(version)
 		return