diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index be5b9225d71b..cc489107853b 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -425,6 +425,8 @@
 
 - The `shadowstack` hardening flag has been added, though disabled by default.
 
+- `xxd` is now provided by the `tinyxxd` package, rather than `vim.xxd`, to reduce closure size and vulnerability impact. Since it has the same options and semantics as Vim's `xxd` utility, there is no user impact. Vim's `xxd` remains available as the `vim.xxd` package.
+
 - `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).
 
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
diff --git a/pkgs/by-name/ti/tinyxxd/package.nix b/pkgs/by-name/ti/tinyxxd/package.nix
new file mode 100644
index 000000000000..a19f9d7ef3f3
--- /dev/null
+++ b/pkgs/by-name/ti/tinyxxd/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  installShellFiles,
+  vim,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tinyxxd";
+  version = "1.3.5";
+
+  src = fetchFromGitHub {
+    repo = "tinyxxd";
+    owner = "xyproto";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-W7BrQga98ACrhTHF3UlGQMRmcdJaxgorDP6FpD5mr2A=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    installManPage tinyxxd.1
+
+    # Allow using `tinyxxd` as `xxd`. This is similar to the Arch packaging.
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/tinyxxd/-/blob/main/PKGBUILD
+    ln -s $out/bin/{tiny,}xxd
+    ln -s $out/share/man/man1/{tiny,}xxd.1.gz
+  '';
+
+  meta = {
+    homepage = "https://github.com/xyproto/tinyxxd";
+    description = "Drop-in replacement and standalone version of the hex dump utility that comes with ViM";
+    license = [
+      lib.licenses.mit # or
+      lib.licenses.gpl2Only
+    ];
+    mainProgram = "tinyxxd";
+    maintainers = with lib.maintainers; [
+      emily
+      philiptaron
+    ];
+    platforms = lib.platforms.unix;
+
+    # If the two `xxd` providers are present, choose this one.
+    priority = (vim.xxd.meta.priority or lib.meta.defaultPriority) - 1;
+  };
+})
diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 959d87d5864d..93bb34bba20d 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -224,9 +224,9 @@ let
       darwin = pkgs.darwin.basic_cmds;
     };
     xxd = {
-      linux = pkgs.vim.xxd;
-      darwin = pkgs.vim.xxd;
-      freebsd = pkgs.vim.xxd;
+      linux = pkgs.tinyxxd;
+      darwin = pkgs.tinyxxd;
+      freebsd = pkgs.tinyxxd;
     };
   };