diff --git a/home/modules/globalprotect.nix b/home/modules/globalprotect.nix
index 714ef96..b370ac2 100644
--- a/home/modules/globalprotect.nix
+++ b/home/modules/globalprotect.nix
@@ -1,7 +1,21 @@
 { pkgs, inputs, ... }:
+let
+  pittUsername = "amm503";
+  portal = "portal-palo.pitt.edu";
 
+  # Backup CLI: run `pitt-vpn` to connect via openconnect (extra args forwarded).
+  # openconnect needs root to create the tun device, hence sudo.
+  pitt-vpn = pkgs.writeShellScriptBin "pitt-vpn" ''
+    exec sudo ${pkgs.openconnect}/bin/openconnect \
+      --protocol=gp \
+      --user=${pittUsername} \
+      ${portal} "$@"
+  '';
+in
 {
   home.packages = [
     inputs.globalprotect-openconnect.packages.${pkgs.stdenv.hostPlatform.system}.default
+    pkgs.openconnect
+    pitt-vpn
   ];
 }