diff --git a/pkgs/tools/filesystems/ceph/default.nix b/pkgs/tools/filesystems/ceph/default.nix
index 5fde26dee5bc..ddaa688be613 100644
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@@ -240,13 +240,12 @@ let
         });
 
         # We pin the older `cryptography` 40 here;
-        # this also forces us to pin an older `pyopenssl` because the current one
-        # is not compatible with older `cryptography`, see:
-        #     https://github.com/pyca/pyopenssl/blob/d9752e44127ba36041b045417af8a0bf16ec4f1e/CHANGELOG.rst#2320-2023-05-30
+        # this also forces us to pin other packages, see below
         cryptography = self.callPackage ./old-python-packages/cryptography.nix { };
 
         # This is the most recent version of `pyopenssl` that's still compatible with `cryptography` 40.
         # See https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602
+        # and https://github.com/pyca/pyopenssl/blob/d9752e44127ba36041b045417af8a0bf16ec4f1e/CHANGELOG.rst#2320-2023-05-30
         pyopenssl = super.pyopenssl.overridePythonAttrs (old: rec {
           version = "23.1.1";
           src = fetchPypi {
@@ -262,7 +261,12 @@ let
           ];
         });
 
-        fastapi = super.fastapi.overridePythonAttrs (old: rec {
+        # This is the most recent version of `trustme` that's still compatible with `cryptography` 40.
+        # See https://github.com/NixOS/nixpkgs/issues/359723
+        # and https://github.com/python-trio/trustme/commit/586f7759d5c27beb44da60615a71848eb2a5a490
+        trustme = self.callPackage ./old-python-packages/trustme.nix { };
+
+        fastapi = super.fastapi.overridePythonAttrs (old: {
           # Flaky test:
           #     ResourceWarning: Unclosed <MemoryObjectSendStream>
           # Unclear whether it's flaky in general or only in this overridden package set.
diff --git a/pkgs/tools/filesystems/ceph/old-python-packages/trustme.nix b/pkgs/tools/filesystems/ceph/old-python-packages/trustme.nix
new file mode 100644
index 000000000000..31578bcb8d7d
--- /dev/null
+++ b/pkgs/tools/filesystems/ceph/old-python-packages/trustme.nix
@@ -0,0 +1,52 @@
+# This older version only exists because `ceph` needs it, see its package.
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchPypi,
+  idna,
+  pyopenssl,
+  pytestCheckHook,
+  pythonOlder,
+  service-identity,
+}:
+
+buildPythonPackage rec {
+  pname = "trustme";
+  version = "1.1.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-U3Wtf7QnB0vslWWS4NTuKkz02miTThukvPQhcSa8ReY=";
+  };
+
+  propagatedBuildInputs = [
+    cryptography
+    idna
+  ];
+
+  nativeCheckInputs = [
+    pyopenssl
+    pytestCheckHook
+    service-identity
+  ];
+
+  # Some of the tests use localhost networking.
+  __darwinAllowLocalNetworking = true;
+
+  pythonImportsCheck = [ "trustme" ];
+
+  meta = with lib; {
+    description = "High quality TLS certs while you wait, for the discerning tester";
+    homepage = "https://github.com/python-trio/trustme";
+    changelog = "https://trustme.readthedocs.io/en/latest/#change-history";
+    license = with licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with maintainers; [ jfly ];
+  };
+}