diff --git a/pkgs/os-specific/linux/fscrypt/default.nix b/pkgs/os-specific/linux/fscrypt/default.nix
new file mode 100644
index 00000000000..1564069a0a9
--- /dev/null
+++ b/pkgs/os-specific/linux/fscrypt/default.nix
@@ -0,0 +1,33 @@
+{ stdenv, buildGoPackage, fetchFromGitHub, libargon2, pam }:
+
+# Don't use this for anything important yet!
+
+buildGoPackage rec {
+  name = "fscrypt-${version}";
+  version = "0.2.1";
+
+  goPackagePath = "github.com/google/fscrypt";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "fscrypt";
+    rev = version;
+    sha256 = "0ais6l0dxinnspi6cjnzyk55cdkfsz2bzbaybg6cb4q8a5kzaccq";
+  };
+
+  buildInputs = [ libargon2 pam ];
+
+  meta = with stdenv.lib; {
+    description =
+      "A high-level tool for the management of Linux filesystem encryption";
+    longDescription = ''
+      This tool manages metadata, key generation, key wrapping, PAM integration,
+      and provides a uniform interface for creating and modifying encrypted
+      directories.
+    '';
+    inherit (src.meta) homepage;
+    license = licenses.asl20;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 3fe36446518..4df368a51ed 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12024,6 +12024,9 @@ with pkgs;
 
   dstat = callPackage ../os-specific/linux/dstat { };
 
+  # unstable until the first 1.x release
+  fscrypt-experimental = callPackage ../os-specific/linux/fscrypt { };
+
   fwupd = callPackage ../os-specific/linux/firmware/fwupd { inherit (gnome2) gtk_doc; inherit (python3Packages) pygobject3 pillow; };
 
   fwupdate = callPackage ../os-specific/linux/firmware/fwupdate { };