diff --git a/pkgs/by-name/in/incus-spawn/package.nix b/pkgs/by-name/in/incus-spawn/package.nix
new file mode 100644
index 000000000000..911187f25075
--- /dev/null
+++ b/pkgs/by-name/in/incus-spawn/package.nix
@@ -0,0 +1,113 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  autoPatchelfHook,
+  installShellFiles,
+  zlib,
+  testers,
+  incus-spawn,
+}:
+
+let
+  stdenv = stdenvNoCC;
+  version = "0.2.7";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/Sanne/incus-spawn/releases/download/v${version}/incus-spawn-linux-amd64";
+      hash = "sha256-jgdNuVfVshbg8piAGGpIy4cnJj5glbsGqOENDBoqpzI=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/Sanne/incus-spawn/releases/download/v${version}/incus-spawn-linux-aarch64";
+      hash = "sha256-Y7OaNgQKAN/HVt75+tawrCtkyZdAHfAiUxx2a0eD5P8=";
+    };
+    aarch64-darwin = fetchurl {
+      url = "https://github.com/Sanne/incus-spawn/releases/download/v${version}/incus-spawn-macos-aarch64";
+      hash = "sha256-Uv0v7LxIcB0oNEnW1vK9Iy6MOwxoUeqtszGfsS5wt6k=";
+    };
+  };
+
+  git-remote-isx = fetchurl {
+    url = "https://github.com/Sanne/incus-spawn/releases/download/v${version}/git-remote-isx";
+    hash = "sha256-I9zmdLzO7VcfLHdgFD2Lvwiq4fkDw885j1JWsL8c+hA=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "incus-spawn";
+  inherit version;
+
+  src =
+    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported platform: ${stdenv.hostPlatform.system}");
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontStrip = stdenv.hostPlatform.isDarwin;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 $src $out/bin/isx
+    install -Dm755 ${git-remote-isx} $out/bin/git-remote-isx
+
+    runHook postInstall
+  '';
+
+  # Generate shell completions after autoPatchelfHook has patched the ELF binary.
+  # On Linux, autoPatchelfHook runs in postFixupHooks so we use installCheckPhase
+  # which runs after fixup is fully complete. On Darwin no patching is needed but
+  # we keep the same phase for consistency.
+  doInstallCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    installShellCompletion --cmd isx \
+      --bash <($out/bin/isx completion bash) \
+      --zsh <($out/bin/isx completion zsh) \
+      --fish <($out/bin/isx completion fish)
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = incus-spawn;
+      command = "isx --version";
+    };
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "CLI tool for managing isolated Incus development environments";
+    longDescription = ''
+      incus-spawn (isx) creates isolated Linux development environments using
+      Incus system containers with copy-on-write branching, a MITM TLS proxy
+      for credential isolation, and an interactive TUI.
+    '';
+    homepage = "https://github.com/Sanne/incus-spawn";
+    changelog = "https://github.com/Sanne/incus-spawn/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
+    mainProgram = "isx";
+    maintainers = with lib.maintainers; [
+      galder
+    ];
+  };
+})
diff --git a/pkgs/by-name/in/incus-spawn/update.sh b/pkgs/by-name/in/incus-spawn/update.sh
new file mode 100755
index 000000000000..38513633289b
--- /dev/null
+++ b/pkgs/by-name/in/incus-spawn/update.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env nix
+#!nix shell --ignore-environment .#cacert .#coreutils .#curl .#bash .#jq .#nix --command bash
+# Update script for incus-spawn in nixpkgs.
+# Invoked by: nix-shell maintainers/scripts/update.nix --argstr commit true --argstr package incus-spawn
+# Or manually: ./update.sh [version]
+
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+REPO="Sanne/incus-spawn"
+PACKAGE_NIX="package.nix"
+
+# Determine target version
+if [[ -n "${1:-}" ]]; then
+    VERSION="${1#v}"
+else
+    VERSION=$(curl -fsSL "https://api.github.com/repos/$REPO/releases/latest" | jq -r '.tag_name' | sed 's/^v//')
+fi
+
+CURRENT=$(grep 'version = "' "$PACKAGE_NIX" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+
+if [[ "$VERSION" == "$CURRENT" ]]; then
+    echo "incus-spawn is already at $VERSION"
+    exit 0
+fi
+
+echo "Updating incus-spawn: $CURRENT -> $VERSION"
+
+# Compute SRI hashes for each artifact
+hash_for() {
+    local url="$1"
+    nix hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url --type sha256 "$url" 2>/dev/null)"
+}
+
+BASE_URL="https://github.com/$REPO/releases/download/v$VERSION"
+
+HASH_AMD64=$(hash_for "$BASE_URL/incus-spawn-linux-amd64")
+HASH_AARCH64=$(hash_for "$BASE_URL/incus-spawn-linux-aarch64")
+HASH_MACOS=$(hash_for "$BASE_URL/incus-spawn-macos-aarch64")
+HASH_GIT_REMOTE=$(hash_for "$BASE_URL/git-remote-isx")
+
+echo "  linux-amd64:    $HASH_AMD64"
+echo "  linux-aarch64:  $HASH_AARCH64"
+echo "  macos-aarch64:  $HASH_MACOS"
+echo "  git-remote-isx: $HASH_GIT_REMOTE"
+
+# Update package.nix in place
+sed -i \
+    -e "0,/version = \"[^\"]*\"/s/version = \"[^\"]*\"/version = \"$VERSION\"/" \
+    -e "/x86_64-linux/,/};/{s|hash = \"[^\"]*\"|hash = \"$HASH_AMD64\"|}" \
+    -e "/aarch64-linux/,/};/{s|hash = \"[^\"]*\"|hash = \"$HASH_AARCH64\"|}" \
+    -e "/aarch64-darwin/,/};/{s|hash = \"[^\"]*\"|hash = \"$HASH_MACOS\"|}" \
+    -e "/git-remote-isx/,/};/{s|hash = \"[^\"]*\"|hash = \"$HASH_GIT_REMOTE\"|}" \
+    "$PACKAGE_NIX"
+
+echo "Updated $PACKAGE_NIX to $VERSION"