diff --git a/pkgs/development/python-modules/credstash/default.nix b/pkgs/development/python-modules/credstash/default.nix
index db48326535d..e761792bb99 100644
--- a/pkgs/development/python-modules/credstash/default.nix
+++ b/pkgs/development/python-modules/credstash/default.nix
@@ -9,6 +9,14 @@ buildPythonPackage rec {
     sha256 = "814560f99ae2409e2c6d906d878f9dadada5d1d0a950aafb6b2c0d535291bdfb";
   };
 
+  # The install phase puts an executable and a copy of the library it imports in
+  # bin/credstash and bin/credstash.py, despite the fact that the library is also
+  # installed to lib/python<version>/site-packages/credstash.py.
+  # If we apply wrapPythonPrograms to bin/credstash.py then the executable will try
+  # to import the credstash module from the resulting shell script. Removing this
+  # file ensures that Python imports the module from site-packages library.
+  postInstall = "rm $out/bin/credstash.py";
+
   nativeBuildInputs = [ nose ];
 
   propagatedBuildInputs = [ cryptography boto3 pyyaml docutils ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e8c269aaeee..2ddb4755c32 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8439,6 +8439,8 @@ in
     llvmPackages = llvmPackages_7;
   };
 
+  credstash = with python3Packages; toPythonApplication credstash;
+
   creduce = callPackage ../development/tools/misc/creduce {
     inherit (perlPackages) perl
       ExporterLite FileWhich GetoptTabular RegexpCommon TermReadKey;