diff --git a/pkgs/tools/admin/certbot/default.nix b/pkgs/development/python-modules/certbot/default.nix
similarity index 56%
rename from pkgs/tools/admin/certbot/default.nix
rename to pkgs/development/python-modules/certbot/default.nix
index 67d698a64fa..79e5c3288b7 100644
--- a/pkgs/tools/admin/certbot/default.nix
+++ b/pkgs/development/python-modules/certbot/default.nix
@@ -1,12 +1,13 @@
 { lib
-, buildPythonApplication
+, buildPythonPackage
+, python, runCommand
 , fetchFromGitHub
 , ConfigArgParse, acme, configobj, cryptography, distro, josepy, parsedatetime, pyRFC3339, pyopenssl, pytz, requests, six, zope_component, zope_interface
 , dialog, mock, gnureadline
-, pytest_xdist, pytest, dateutil
+, pytest_xdist, pytest, pytestCheckHook, dateutil
 }:
 
-buildPythonApplication rec {
+buildPythonPackage rec {
   pname = "certbot";
   version = "1.6.0";
 
@@ -17,6 +18,8 @@ buildPythonApplication rec {
     sha256 = "1y0m5qm853i6pcpb2mrf8kjkr9wr80mdrx1qmck38ayvr2v2p5lc";
   };
 
+  sourceRoot = "source/${pname}";
+
   propagatedBuildInputs = [
     ConfigArgParse
     acme
@@ -36,21 +39,32 @@ buildPythonApplication rec {
 
   buildInputs = [ dialog mock gnureadline ];
 
-  checkInputs = [ pytest_xdist pytest dateutil ];
+  checkInputs = [
+    dateutil
+    pytest
+    pytestCheckHook
+    pytest_xdist
+  ];
 
-  preBuild = ''
-    cd certbot
-  '';
-
-  postInstall = ''
-    for i in $out/bin/*; do
-      wrapProgram "$i" --prefix PYTHONPATH : "$PYTHONPATH" \
-                       --prefix PATH : "${dialog}/bin:$PATH"
-    done
-  '';
+  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];
 
   doCheck = true;
 
+  makeWrapperArgs = [ "--prefix PATH : ${dialog}/bin" ];
+
+  # certbot.withPlugins has a similar calling convention as python*.withPackages
+  # it gets invoked with a lambda, and invokes that lambda with the python package set matching certbot's:
+  # certbot.withPlugins (cp: [ cp.certbot-dns-foo ])
+  passthru.withPlugins = f: let
+    pythonEnv = python.withPackages f;
+
+  in runCommand "certbot-with-plugins" {
+  } ''
+    mkdir -p $out/bin
+    cd $out/bin
+    ln -s ${pythonEnv}/bin/certbot
+  '';
+
   meta = with lib; {
     homepage = src.meta.homepage;
     description = "ACME client that can obtain certs and extensibly update server configurations";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e68a7d72960..1fc0a304ae0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11598,7 +11598,13 @@ in
     ogre = ogre1_10;
   };
 
-  certbot = python3Packages.callPackage ../tools/admin/certbot { };
+  certbot = python3.pkgs.toPythonApplication python3.pkgs.certbot;
+
+  certbot-full = certbot.withPlugins (cp: with cp; [
+    certbot-dns-cloudflare
+    certbot-dns-rfc2136
+    certbot-dns-route53
+  ]);
 
   caf = callPackage ../development/libraries/caf {};
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fc5f73d2108..1f43cc00d03 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -585,6 +585,8 @@ in {
 
   cdecimal = callPackage ../development/python-modules/cdecimal { };
 
+  certbot = callPackage ../development/python-modules/certbot { };
+
   certbot-dns-cloudflare = callPackage ../development/python-modules/certbot-dns-cloudflare { };
 
   certbot-dns-rfc2136 = callPackage ../development/python-modules/certbot-dns-rfc2136 { };
@@ -1047,7 +1049,7 @@ in {
   nvchecker = callPackage ../development/python-modules/nvchecker { };
 
   numericalunits = callPackage ../development/python-modules/numericalunits { };
-  
+
   nunavut = callPackage ../development/python-modules/nunavut { };
 
   oath = callPackage ../development/python-modules/oath { };
@@ -1681,7 +1683,7 @@ in {
     inherit (pkgs.darwin.apple_sdk.frameworks) ApplicationServices CoreServices;
   };
 
-  pyuavcan = callPackage ../development/python-modules/pyuavcan { 
+  pyuavcan = callPackage ../development/python-modules/pyuavcan {
     # this version pinpoint to anold version is necessary due to a regression
     nunavut = self.nunavut.overridePythonAttrs ( old: rec {
       version = "0.2.3";
@@ -4495,7 +4497,7 @@ in {
   }));
 
   libkeepass = callPackage ../development/python-modules/libkeepass { };
-  
+
   libredwg = toPythonModule (pkgs.libredwg.override {
     enablePython = true;
     inherit (self) python libxml2;
@@ -4548,7 +4550,7 @@ in {
 
   locustio = callPackage ../development/python-modules/locustio { };
 
-  llvmlite = callPackage ../development/python-modules/llvmlite { 
+  llvmlite = callPackage ../development/python-modules/llvmlite {
     llvm = pkgs.llvm_9; # llvmlite always requires a specific version of llvm.
   };
 
@@ -6710,7 +6712,7 @@ in {
 
   zipp = if pythonOlder "3.6" then
     callPackage ../development/python-modules/zipp/1.nix { }
-  else 
+  else
     callPackage ../development/python-modules/zipp { };
 
   zope_broken = callPackage ../development/python-modules/zope_broken { };