diff --git a/Makefile b/Makefile
index b199293..5f00601 100644
--- a/Makefile
+++ b/Makefile
@@ -44,3 +44,10 @@ pull/%:
 	qvm-run -p $(GUEST) "cd $(GUEST_REPO) && git update-ref refs/remotes/dom0/$* $*" </dev/null
 
 	@echo "updated branch $* from $(GUEST)"
+
+apply:
+	echo "Applying salt states"
+	pushd ./guardian
+	sudo qubesctl top.enable guardian
+	sudo qubesctl --show-output --all state.apply
+	popd
diff --git a/guardian/guardian-vms.sls b/guardian/guardian-vms.sls
new file mode 100644
index 0000000..6e64d1c
--- /dev/null
+++ b/guardian/guardian-vms.sls
@@ -0,0 +1,18 @@
+create-guardian-template:
+  qvm.vm:
+    - name: guardian-template
+    - clone: 
+      - source: fedora-42
+      - label: black
+    - prefs:
+      - netvm: ""
+
+create-app:
+  qvm.vm:
+    - name: app
+    - present:
+      - template: guardian-template
+      - label: green
+    - prefs:
+      - template: guardian-template
+      - netvm: ""
diff --git a/guardian/guardian.top b/guardian/guardian.top
new file mode 100644
index 0000000..72f7269
--- /dev/null
+++ b/guardian/guardian.top
@@ -0,0 +1,3 @@
+base:
+  dom0:
+    - guardian-vms