diff --git a/pkgs/by-name/so/sonar-scanner-cli/package.nix b/pkgs/by-name/so/sonar-scanner-cli/package.nix
new file mode 100644
index 000000000000..94c03ac15530
--- /dev/null
+++ b/pkgs/by-name/so/sonar-scanner-cli/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  coreutils,
+  fetchFromGitHub,
+  jre,
+  libarchive,
+  makeWrapper,
+  maven,
+  nix-update-script,
+}:
+
+maven.buildMavenPackage rec {
+  pname = "sonar-scanner-cli";
+  version = "6.2.1.4610";
+
+  src = fetchFromGitHub {
+    owner = "SonarSource";
+    repo = "sonar-scanner-cli";
+    rev = "refs/tags/${version}";
+    hash = "sha256-k1gZO3h6ZGwxJNQ5QwUH96aDPGpJuEn6HYUsYOpqo+g=";
+  };
+
+  mvnHash = "sha256-RNWE9wjX2CP6G/Hoh/vJExUkTEsSh5D+1PAMZ9TuIh0=";
+
+  mvnParameters = "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z";
+
+  nativeBuildInputs = [
+    # For bsdtar (name is a misnomer since it handles multiple archive formats) to extract nested directories from .zip files.
+    libarchive
+    makeWrapper
+  ];
+
+  doCheck = false;
+
+  # The .zip file with the programs is placed at "target/sonar-scanner-{project.version}.zip".
+  #
+  # To compute this .zip file path directly, we need to get the project version from the project's pom.xml.
+  #
+  # Parsing pom.xml is unsafe because project versions can be set dynamically. We need to use maven-help-plugin to get the evaluated value instead.
+  #
+  # Network isolation, however, prevents Maven from downloading packages in our shell script so we can't do this:
+  #
+  #   MAVEN_PROJECT_VERSION=$(mvn org.apache.maven.plugins:maven-help-plugin:3.4.1:evaluate \
+  #     -Dmaven.repo.local=.m2 \
+  #     -Dexpression=project.version \
+  #     -DforceStdout \
+  #     --quiet)
+  #
+  # We'll use wildcard expansion instead to find (what should be) the only .zip file in the "target" directory.
+  installPhase = ''
+    mkdir $out
+
+    FILES=(target/sonar-scanner-*.zip)
+    bsdtar --extract --file ''${FILES[0]} --strip-components 1 --directory $out
+
+    wrapProgram $out/bin/sonar-scanner \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          coreutils
+          jre
+        ]
+      } \
+      --set JAVA_HOME ${jre}
+
+    wrapProgram $out/bin/sonar-scanner-debug \
+      --prefix PATH : ${lib.makeBinPath [ coreutils ]}
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Scanner CLI for SonarQube and SonarCloud";
+    homepage = "https://github.com/SonarSource/sonar-scanner-cli";
+    license = lib.licenses.lgpl3Only;
+    mainProgram = "sonar-scanner";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ peterromfeldhk ];
+  };
+}
diff --git a/pkgs/tools/security/sonar-scanner-cli/default.nix b/pkgs/tools/security/sonar-scanner-cli/default.nix
deleted file mode 100644
index b97a2bc3a105..000000000000
--- a/pkgs/tools/security/sonar-scanner-cli/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{ stdenv, lib, fetchurl, unzip, jre }:
-
-let
-
-  version = "4.7.0.2747";
-
-  sonarScannerArchPackage = {
-    "x86_64-linux" = {
-      url = "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${version}-linux.zip";
-      sha256 = "0qy97lcn9nfwg0x32v9x5kh5jswnjyw3wpvxj45z7cddlj2is4iy";
-    };
-    "x86_64-darwin" = {
-      url = "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${version}-macosx.zip";
-      sha256 = "0f8km7wqkw09g01l03kcrjgvq7b6xclzpvb5r64ymsmrc39p0ylp";
-    };
-  };
-
-in stdenv.mkDerivation rec {
-  inherit version;
-  pname = "sonar-scanner-cli";
-
-  src = fetchurl sonarScannerArchPackage.${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
-
-  nativeBuildInputs = [ unzip ];
-
-  installPhase = ''
-    mkdir -p $out/lib
-    cp -r lib/* $out/lib/
-    mkdir -p $out/bin
-    cp bin/* $out/bin/
-    mkdir -p $out/conf
-    cp conf/* $out/conf/
-  '';
-
-  fixupPhase = ''
-    substituteInPlace $out/bin/sonar-scanner \
-      --replace "\$sonar_scanner_home/jre" "${lib.getBin jre}"
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/SonarSource/sonar-scanner-cli";
-    description = "SonarQube Scanner used to start code analysis";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ peterromfeldhk ];
-    platforms = builtins.attrNames sonarScannerArchPackage;
-  };
-}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 153f1675d545..65f180b036d5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12657,8 +12657,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
-  sonar-scanner-cli = callPackage ../tools/security/sonar-scanner-cli { };
-
   snapshot = callPackage ../applications/graphics/snapshot { };
 
   solvespace = callPackage ../applications/graphics/solvespace { };