diff --git a/pkgs/tools/security/pinentry/default.nix b/pkgs/tools/security/pinentry/default.nix
index 30d717c7bc1..8ccf1ba7ccd 100644
--- a/pkgs/tools/security/pinentry/default.nix
+++ b/pkgs/tools/security/pinentry/default.nix
@@ -10,11 +10,11 @@ let
 in
 with stdenv.lib;
 stdenv.mkDerivation rec {
-  name = "pinentry-0.9.5";
+  name = "pinentry-0.9.6";
 
   src = fetchurl {
     url = "mirror://gnupg/pinentry/${name}.tar.bz2";
-    sha256 = "1338hj1h3sh34897120y30x12b64wyj3xjzzk5asm2hdzhxgsmva";
+    sha256 = "0rhyw1vk28kgasjp22myf7m2q8kycw82d65pr9kgh93z17lj849a";
   };
 
   buildInputs = [ libgpgerror libassuan libcap gtk2 ncurses qt4 ];
diff --git a/pkgs/tools/security/pinentry/qt5.nix b/pkgs/tools/security/pinentry/qt5.nix
new file mode 100644
index 00000000000..d0811cdd11a
--- /dev/null
+++ b/pkgs/tools/security/pinentry/qt5.nix
@@ -0,0 +1,47 @@
+{ fetchurl, stdenv, pkgconfig
+, libgpgerror, libassuan
+, qtbase
+, libcap ? null
+}:
+
+let
+  mkFlag = pfxTrue: pfxFalse: cond: name: "--${if cond then pfxTrue else pfxFalse}-${name}";
+  mkEnable = mkFlag "enable" "disable";
+  mkWith = mkFlag "with" "without";
+in
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "pinentry-0.9.6";
+
+  src = fetchurl {
+    url = "mirror://gnupg/pinentry/${name}.tar.bz2";
+    sha256 = "0rhyw1vk28kgasjp22myf7m2q8kycw82d65pr9kgh93z17lj849a";
+  };
+
+  buildInputs = [ libgpgerror libassuan libcap qtbase ];
+
+  # configure cannot find moc on its own
+  preConfigure = ''
+    export QTDIR="${qtbase}"
+    export MOC="${qtbase}/bin/moc"
+  '';
+
+  configureFlags = [
+    (mkWith   (libcap != null)  "libcap")
+    (mkEnable true "pinentry-qt")
+  ];
+
+  nativeBuildInputs = [ pkgconfig ];
+
+  meta = {
+    homepage = "http://gnupg.org/aegypten2/";
+    description = "GnuPG's interface to passphrase input";
+    license = stdenv.lib.licenses.gpl2Plus;
+    platforms = stdenv.lib.platforms.all;
+    longDescription = ''
+      Pinentry provides a console and (optional) GTK+ and Qt GUIs allowing users
+      to enter a passphrase when `gpg' or `gpg2' is run and needs it.
+    '';
+    maintainers = [ stdenv.lib.maintainers.ttuegel ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a3e0b9ab8e3..a88ed84b3fc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2711,6 +2711,18 @@ let
     qt4 = null;
   };
 
+  pinentry_ncurses = pinentry.override {
+    gtk2 = null;
+  };
+
+  pinentry_qt4 = pinentry_ncurses.override {
+    inherit qt4;
+  };
+
+  pinentry_qt5 = qt55Libs.callPackage ../tools/security/pinentry/qt5.nix {
+    libcap = if stdenv.isDarwin then null else libcap;
+  };
+
   pius = callPackage ../tools/security/pius { };
 
   pk2cmd = callPackage ../tools/misc/pk2cmd { };