diff --git a/pkgs/tools/security/sequoia-tool/default.nix b/pkgs/tools/security/sequoia-tool/default.nix
new file mode 100644
index 00000000000..00472c1a3aa
--- /dev/null
+++ b/pkgs/tools/security/sequoia-tool/default.nix
@@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitLab, rustPlatform, darwin
+, pkgconfig, capnproto, clang, libclang, nettle, openssl, sqlite }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "sequoia-tool";
+  version = "0.9.0";
+
+  src = fetchFromGitLab {
+    owner = "sequoia-pgp";
+    repo = "sequoia";
+    rev = "v${version}";
+    sha256 = "13dzwdzz33dy2lgnznsv8wqnw2501f2ggrkfwpqy5x6d1kgms8rj";
+  };
+
+  nativeBuildInputs = [ pkgconfig clang libclang ];
+  buildInputs = [ capnproto nettle openssl sqlite ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.Security ];
+
+  LIBCLANG_PATH = libclang + "/lib";
+
+  cargoBuildFlags = [ "--package=sequoia-tool" ];
+
+  cargoSha256 = "1zcnkpzcar3a2fk2rn3i3nb70b59ds9fpfa44f15r3aaxajsdhdi";
+
+  meta = with stdenv.lib; {
+    description = "A command-line frontend for Sequoia, an implementation of OpenPGP";
+    homepage = https://sequoia-pgp.org/;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ minijackson ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 88d00ba7133..ca3fd42fb78 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5903,6 +5903,8 @@ in
 
   seqdiag = with python3Packages; toPythonApplication seqdiag;
 
+  sequoia-tool = callPackage ../tools/security/sequoia-tool { inherit (llvmPackages) libclang; };
+
   sewer = callPackage ../tools/admin/sewer { };
 
   screenfetch = callPackage ../tools/misc/screenfetch { };