diff --git a/developer/services/qrexec.md b/developer/services/qrexec.md
index 8f1a2b5b..dcef3bd6 100644
--- a/developer/services/qrexec.md
+++ b/developer/services/qrexec.md
@@ -39,6 +39,8 @@ Typically, the first thing that a `qrexec-client` instance does is to send a req
 `qrexec-client` starts a vchan server, which `qrexec-agent` then connects to.
 Once this channel is established, stdin/stdout/stderr from the VMprocess is passed between `qrexec-agent` and the `qrexec-client` process.
 
+![qrexec basics diagram](/attachment/wiki/qrexec3/qrexec3-basics.png)
+
 The `qrexec-client` command is used to make connections to VMs from dom0.
 For example, the following command