diff --git a/pkgs/tools/security/gnupg1/default.nix b/pkgs/tools/security/gnupg/1.nix
similarity index 100%
rename from pkgs/tools/security/gnupg1/default.nix
rename to pkgs/tools/security/gnupg/1.nix
diff --git a/pkgs/tools/security/gnupg1compat/default.nix b/pkgs/tools/security/gnupg/1compat.nix
similarity index 100%
rename from pkgs/tools/security/gnupg1compat/default.nix
rename to pkgs/tools/security/gnupg/1compat.nix
diff --git a/pkgs/tools/security/gnupg/default.nix b/pkgs/tools/security/gnupg/20.nix
similarity index 100%
rename from pkgs/tools/security/gnupg/default.nix
rename to pkgs/tools/security/gnupg/20.nix
diff --git a/pkgs/tools/security/gnupg/21.nix b/pkgs/tools/security/gnupg/21.nix
new file mode 100644
index 00000000000..8c3854ac23d
--- /dev/null
+++ b/pkgs/tools/security/gnupg/21.nix
@@ -0,0 +1,30 @@
+{ fetchurl, stdenv, pkgconfig, libgcrypt, libassuan, libksba, npth
+, readline ? null, libusb ? null, gnutls ? null, adns ? null, openldap ? null
+, zlib ? null, bzip2 ? null, pinentry ? null
+}:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  name = "gnupg-2.1.0";
+
+  src = fetchurl {
+    url = "mirror://gnupg/gnupg/${name}.tar.bz2";
+    sha256 = "12q5shx6ldqad3rky154nv8f2cy57sxy9idivz93ggqm1bsw7a0n";
+  };
+
+  buildInputs = [
+    pkgconfig libgcrypt libassuan libksba npth
+    readline libusb gnutls adns openldap zlib bzip2
+  ];
+
+  configureFlags =
+    optional (pinentry != null) "--with-pinentry-pgm=${pinentry}/bin/pinentry";
+
+  meta = with stdenv.lib; {
+    homepage = http://gnupg.org;
+    description = "a complete and free implementation of the OpenPGP standard";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ wkennington ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d731dd9ea0e..baf9d2cfe4c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1267,14 +1267,22 @@ let
 
   gnupatch = callPackage ../tools/text/gnupatch { };
 
-  gnupg1orig = callPackage ../tools/security/gnupg1 { };
+  gnupg1orig = callPackage ../tools/security/gnupg/1.nix { };
 
-  gnupg1compat = callPackage ../tools/security/gnupg1compat { };
+  gnupg1compat = callPackage ../tools/security/gnupg/1compat.nix { };
 
   # use config.packageOverrides if you prefer original gnupg1
   gnupg1 = gnupg1compat;
 
-  gnupg = callPackage ../tools/security/gnupg { libusb = libusb1; };
+  gnupg20 = callPackage ../tools/security/gnupg/20.nix {
+    libgcrypt = libgcrypt_1_6;
+  };
+
+  gnupg21 = callPackage ../tools/security/gnupg/21.nix {
+    libgcrypt = libgcrypt_1_6;
+  };
+
+  gnupg = gnupg21;
 
   gnuplot = callPackage ../tools/graphics/gnuplot { };