diff --git a/README.md b/README.md
index 8e181d5..f2d5db4 100644
--- a/README.md
+++ b/README.md
@@ -266,6 +266,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **29.12.21:** - Add `install-extension` as a helper for mods to install extensions.
 * **06.12.21:** - Add `DEFAULT_WORKSPACE` env var.
 * **29.11.21:** - Rebase to Ubuntu focal.
 * **16.09.21:** - Fix slow `chown` on large workspace (contents of workspace folder no longer chowned).
diff --git a/readme-vars.yml b/readme-vars.yml
index d2bdcb6..7b86228 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -77,6 +77,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "29.12.21:", desc: "Add `install-extension` as a helper for mods to install extensions." }
   - { date: "06.12.21:", desc: "Add `DEFAULT_WORKSPACE` env var." }
   - { date: "29.11.21:", desc: "Rebase to Ubuntu focal." }
   - { date: "16.09.21:", desc: "Fix slow `chown` on large workspace (contents of workspace folder no longer chowned)." }
diff --git a/root/usr/local/bin/install-extension b/root/usr/local/bin/install-extension
new file mode 100755
index 0000000..16342b9
--- /dev/null
+++ b/root/usr/local/bin/install-extension
@@ -0,0 +1,10 @@
+#!/usr/bin/with-contenv bash
+# shellcheck shell=bash
+
+_install=(/usr/local/bin/code-server "--extensions-dir" "/config/extensions" "--install-extension")
+
+if [ "$(whoami)" == "abc" ]; then
+    "${_install[@]}" "$@"
+else
+    s6-setuidgid abc "${_install[@]}" "$@"
+fi