diff --git a/pkgs/development/python-modules/nkdfu/default.nix b/pkgs/development/python-modules/nkdfu/default.nix
new file mode 100644
index 000000000000..fa094404b8b1
--- /dev/null
+++ b/pkgs/development/python-modules/nkdfu/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildPythonPackage, fetchPypi, fire, tqdm, intelhex, libusb1 }:
+
+buildPythonPackage rec {
+  pname = "nkdfu";
+  version = "0.1";
+  format = "flit";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-Y8GonfCBi3BNMhZ99SN6/SDSa0+dbfPIMPoVzALwH5A=";
+  };
+
+  propagatedBuildInputs = [
+    fire
+    tqdm
+    intelhex
+    libusb1
+  ];
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "nkdfu" ];
+
+  meta = with lib; {
+    description = "Python tool for Nitrokeys' firmware update";
+    homepage = "https://github.com/Nitrokey/nkdfu";
+    license = with licenses; [ gpl2Only ];
+    maintainers = with maintainers; [ frogamic ];
+  };
+}
diff --git a/pkgs/tools/security/pynitrokey/default.nix b/pkgs/tools/security/pynitrokey/default.nix
new file mode 100644
index 000000000000..b50550e74368
--- /dev/null
+++ b/pkgs/tools/security/pynitrokey/default.nix
@@ -0,0 +1,44 @@
+{ python3Packages, lib }:
+
+with python3Packages;
+
+buildPythonApplication rec {
+  pname = "pynitrokey";
+  version = "0.4.9";
+  format = "flit";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-mhH6mVgLRX87PSGTFkj1TE75jU1lwcaRZWbC67T+vWo=";
+  };
+
+  propagatedBuildInputs = [
+    click
+    cryptography
+    ecdsa
+    fido2
+    intelhex
+    pyserial
+    pyusb
+    requests
+    pygments
+    python-dateutil
+    urllib3
+    cffi
+    cbor
+    nkdfu
+  ];
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "pynitrokey" ];
+
+  meta = with lib; {
+    description = "Python client for Nitrokey devices";
+    homepage = "https://github.com/Nitrokey/pynitrokey";
+    license = with licenses; [ asl20 mit ];
+    maintainers = with maintainers; [ frogamic ];
+    mainProgram = "nitropy";
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 778ce279d7e6..387c26cdbe96 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -34203,6 +34203,8 @@ with pkgs;
 
   xrq = callPackage ../applications/misc/xrq { };
 
+  pynitrokey = callPackage ../tools/security/pynitrokey { };
+
   nitrokey-app = libsForQt5.callPackage ../tools/security/nitrokey-app { };
   nitrokey-udev-rules = callPackage ../tools/security/nitrokey-app/udev-rules.nix { };
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 183ea8574ce4..9cd3243d1a98 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5405,6 +5405,8 @@ in {
 
   nix-prefetch-github = callPackage ../development/python-modules/nix-prefetch-github { };
 
+  nkdfu = callPackage ../development/python-modules/nkdfu { };
+
   nltk = callPackage ../development/python-modules/nltk { };
 
   nmapthon2 = callPackage ../development/python-modules/nmapthon2 { };