diff --git a/pkgs/by-name/st/strongswan/package.nix b/pkgs/by-name/st/strongswan/package.nix
index dfbac679e284..83405418bdca 100644
--- a/pkgs/by-name/st/strongswan/package.nix
+++ b/pkgs/by-name/st/strongswan/package.nix
@@ -5,6 +5,7 @@
 , systemd, pam
 , curl
 , enableTNC            ? false, trousers, sqlite, libxml2
+, enableTPM2           ? false, tpm2-tss
 , enableNetworkManager ? false, networkmanager
 , darwin
 , nixosTests
@@ -31,6 +32,7 @@ stdenv.mkDerivation rec {
   buildInputs =
     [ curl gmp python3 ldns unbound openssl pcsclite ]
     ++ lib.optionals enableTNC [ trousers sqlite libxml2 ]
+    ++ lib.optional enableTPM2 tpm2-tss
     ++ lib.optionals stdenv.hostPlatform.isLinux [ systemd.dev pam iptables ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ SystemConfiguration ])
     ++ lib.optionals enableNetworkManager [ networkmanager glib ];
@@ -80,6 +82,8 @@ stdenv.mkDerivation rec {
          "--with-tss=trousers"
          "--enable-aikgen"
          "--enable-sqlite" ]
+    ++ lib.optionals enableTPM2 [
+      "--enable-tpm" "--enable-tss-tss2" ]
     ++ lib.optionals enableNetworkManager [
          "--enable-nm"
          "--with-nm-ca-dir=/etc/ssl/certs" ]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eb1de0245b72..6d51590a4600 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5033,6 +5033,7 @@ with pkgs;
   stutter = haskell.lib.compose.justStaticExecutables haskellPackages.stutter;
 
   strongswanTNC = strongswan.override { enableTNC = true; };
+  strongswanTPM = strongswan.override { enableTPM2 = true; };
   strongswanNM  = strongswan.override { enableNetworkManager = true; };
 
   stylish-haskell = haskell.lib.compose.justStaticExecutables haskellPackages.stylish-haskell;