diff --git a/pkgs/tools/security/zlint/default.nix b/pkgs/tools/security/zlint/default.nix
new file mode 100644
index 000000000000..4116e3bf7174
--- /dev/null
+++ b/pkgs/tools/security/zlint/default.nix
@@ -0,0 +1,30 @@
+{ buildGoModule, fetchFromGitHub, lib }:
+
+buildGoModule rec {
+  pname = "zlint";
+  version = "3.4.0";
+
+  src = fetchFromGitHub {
+    owner = "zmap";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-l39GdfEKUAw5DQNjx6ZBgfGtengRlUUasm0G07kAA2A=";
+  };
+
+  modRoot = "v3";
+  vendorHash = "sha256-OiHEyMHuSiWDB/1YRvAhErb1h/rFfXXVcagcP386doc=";
+  preBuild = ''
+    # not in the go.mod
+    rm -rf cmd/genTestCerts
+  '';
+
+  # Tests rely on git and we don't have the .git dir because modRoot is in a subdir
+  doCheck = false;
+
+  meta = with lib; {
+    homepage = "https://github.com/zmap/zlint/";
+    license = licenses.asl20;
+    description = "X.509 Certificate Linter focused on Web PKI standards and requirements.";
+    maintainers = with maintainers; [ baloo ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c756cd748f18..173dd01288bd 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -13297,6 +13297,8 @@ with pkgs;
 
   zkar = callPackage ../tools/security/zkar { };
 
+  zlint = callPackage ../tools/security/zlint { };
+
   zmap = callPackage ../tools/security/zmap { };
 
   zpool-iostat-viz = callPackage ../tools/filesystems/zpool-iostat-viz { };