diff --git a/pkgs/by-name/pr/proton-authenticator/package.nix b/pkgs/by-name/pr/proton-authenticator/package.nix
new file mode 100644
index 000000000000..fae6ac5f2bd2
--- /dev/null
+++ b/pkgs/by-name/pr/proton-authenticator/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  autoPatchelfHook,
+  dpkg,
+  glib-networking,
+  wrapGAppsHook4,
+  webkitgtk_4_1,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "proton-authenticator";
+  version = "1.0.0";
+
+  src = fetchurl {
+    url = "https://proton.me/download/authenticator/linux/ProtonAuthenticator_${finalAttrs.version}_amd64.deb";
+    hash = "sha256-Ri6U7tuQa5nde4vjagQKffWgGXbZtANNmeph1X6PFuM=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    dpkg
+    autoPatchelfHook
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    webkitgtk_4_1
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 usr/bin/proton-authenticator $out/bin/${finalAttrs.meta.mainProgram}
+    cp -r usr/share $out
+
+    wrapProgram "$out/bin/${finalAttrs.meta.mainProgram}" \
+      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Two-factor authentication manager with optional sync";
+    homepage = "https://proton.me/authenticator";
+    license = lib.licenses.unfree; # source not yet published
+    maintainers = with lib.maintainers; [ felschr ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    mainProgram = "proton-authenticator";
+  };
+})