diff --git a/README.md b/README.md
index c357891..aa266c4 100644
--- a/README.md
+++ b/README.md
@@ -38,7 +38,7 @@ let
 
         # add package to include in the image, ie. packages that you don't
         # want to install manually later
-        packages = [ "tcpdump" ];
+        packages.include = [ "tcpdump" ];
 
         services.disabled = [ "dnsmasq" ];
 
@@ -80,7 +80,7 @@ in sys.config.system.build.image
 
             # add package to include in the image, ie. packages that you don't
             # want to install manually later
-            packages = [ "tcpdump" ];
+            packages.include = [ "tcpdump" ];
 
             services.disabled = [ "dnsmasq" ];
 
diff --git a/example.nix b/example.nix
index 397d3c4..3dc70ae 100644
--- a/example.nix
+++ b/example.nix
@@ -3,7 +3,7 @@
 {
   system.profile = "avm_fritz7412";
 
-  packages = [ "tcpdump" "vxlan" "kmod-vxlan" ];
+  packages.include = [ "tcpdump" "vxlan" "kmod-vxlan" ];
 
   files = pkgs.runCommandNoCC "image-files" { } ''
        mkdir -p $out/etc/uci-defaults
diff --git a/lib/modules/build.nix b/lib/modules/build.nix
index b8841b3..108b159 100644
--- a/lib/modules/build.nix
+++ b/lib/modules/build.nix
@@ -4,7 +4,9 @@
   system.build.image = import ../../builder.nix {
     inherit pkgs;
     inherit (config.system) release target variant profile;
-    inherit (config) packages files;
+    inherit (config) files;
+    packages = config.packages.include
+      ++ map (x: "-${x}") config.packages.exclude;
     disabledServices = config.services.disabled;
   };
 }
diff --git a/lib/modules/packages.nix b/lib/modules/packages.nix
index fa8e34a..596458c 100644
--- a/lib/modules/packages.nix
+++ b/lib/modules/packages.nix
@@ -1,10 +1,18 @@
 { lib, ... }:
 
 {
-  options.packages = with lib; mkOption {
-    type = with types; listOf str;
-    default = [ ];
-    example = [ "tcpdump" "vxlan" "kmod-vxlan" ];
-    description = "Extra OpenWRT packages (can be prefixed with "-").";
+  options.packages = with lib; {
+    include = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [ "tcpdump" "vxlan" "kmod-vxlan" ];
+      description = "Extra OpenWRT packages (can be prefixed with " - ").";
+    };
+    exclude = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [ "vi" ];
+      description = "OpenWRT packages to be excluded.";
+    };
   };
 }