diff --git a/tools/find_systems.zsh b/tools/find_systems.zsh
new file mode 100755
index 0000000..bc8fc9e
--- /dev/null
+++ b/tools/find_systems.zsh
@@ -0,0 +1,41 @@
+#!/usr/bin/env zsh
+#
+# find_systems.zsh
+# Sweeps a subnet for hosts with SSH open, then queries each as `kiosk`
+# for hostname + NixOS configuration revision.
+#
+# Usage: ./find_systems.zsh [subnet]
+#   subnet defaults to 192.168.4.0/24
+
+set -uo pipefail # no -e: we want to keep going past unreachable hosts
+
+SUBNET="${1:-192.168.4.0/24}"
+SSH_USER="kiosk"
+SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=5 -o StrictHostKeyChecking=accept-new)
+
+echo "Scanning $SUBNET for open SSH (22)..."
+ips=("${(@f)$(nmap -p 22 --open -Pn "$SUBNET" -oG - | awk '/22\/open/ {print $2}')}")
+
+if [[ ${#ips[@]} -eq 0 ]]; then
+  echo "No hosts with open SSH found on $SUBNET."
+  exit 0
+fi
+
+echo "Found ${#ips[@]} host(s). Querying..."
+echo
+
+fail_count=0
+
+for ip in "${ips[@]}"; do
+  echo "== $ip =="
+  if ssh "${SSH_OPTS[@]}" "${SSH_USER}@${ip}" \
+    'echo "host: $(hostname)"; echo "rev:  $(nixos-version --configuration-revision)"'; then
+    :
+  else
+    echo "  (unreachable or auth failed)"
+    ((fail_count++))
+  fi
+  echo
+done
+
+echo "Done. ${fail_count} of ${#ips[@]} host(s) failed to respond."