diff --git a/pkgs/development/python-modules/pygitguardian/default.nix b/pkgs/development/python-modules/pygitguardian/default.nix
new file mode 100644
index 000000000000..9eff24633034
--- /dev/null
+++ b/pkgs/development/python-modules/pygitguardian/default.nix
@@ -0,0 +1,72 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, marshmallow
+, marshmallow-dataclass
+, pytestCheckHook
+, pythonOlder
+, requests
+, responses
+, setuptools
+, typing-extensions
+, vcrpy
+}:
+
+buildPythonPackage rec {
+  pname = "pygitguardian";
+  version = "1.9.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "GitGuardian";
+    repo = "py-gitguardian";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-lDs2H5GUf3fhTSX+20dD0FNW2oirkgQQk5t7GKSnKe4=";
+  };
+
+  nativeBuildInputs = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    marshmallow
+    marshmallow-dataclass
+    requests
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    vcrpy
+    responses
+  ];
+
+  pythonImportsCheck = [
+    "pygitguardian"
+  ];
+
+  disabledTests = [
+    # Tests require an API key
+    "test_health_check"
+    "test_multi_content_scan"
+    "test_content_scan_exceptions"
+    "test_multi_content_exceptions"
+    "test_content_scan"
+    "test_extra_headers"
+    "test_multiscan_parameters"
+    "test_quota_overview"
+    "test_versions_from_headers"
+    "test_create_honeytoken"
+    "test_create_jwt"
+  ];
+
+  meta = with lib; {
+    description = "Library to access the GitGuardian API";
+    homepage = "https://github.com/GitGuardian/py-gitguardian";
+    changelog = "https://github.com/GitGuardian/py-gitguardian/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-voluptuous/default.nix b/pkgs/development/python-modules/pytest-voluptuous/default.nix
new file mode 100644
index 000000000000..ce1081e5febf
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-voluptuous/default.nix
@@ -0,0 +1,53 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytest
+, pytestCheckHook
+, pythonOlder
+, six
+, voluptuous
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-voluptuous";
+  version = "1.2.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "F-Secure";
+    repo = "pytest-voluptuous";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xdj4qCSSJQI9Rb1WyUYrAg1I5wQ5o6IJyIjJAafP/LY=";
+  };
+
+  buildInputs = [
+    pytest
+  ];
+
+  propagatedBuildInputs = [
+    voluptuous
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    six
+  ];
+
+  pythonImportsCheck = [
+    "pytest_voluptuous"
+  ];
+
+  pytestFlagsArray = [
+    "tests/test_plugin.py"
+  ];
+
+  meta = with lib; {
+    description = "A pytest plugin for asserting data against voluptuous schema";
+    homepage = "https://github.com/F-Secure/pytest-voluptuous";
+    changelog = "https://github.com/F-Secure/pytest-voluptuous/blob/${version}/CHANGELOG.rst";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
new file mode 100644
index 000000000000..3f275875ed48
--- /dev/null
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -0,0 +1,78 @@
+{ lib
+, fetchFromGitHub
+, git
+, python3
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "ggshield";
+  version = "1.18.0";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "GitGuardian";
+    repo = "ggshield";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-CWWgt2Ec8ChhH+nL6DkGqI3GsR52HforUYaaxSpKgCs=";
+  };
+
+  pythonRelaxDeps = true;
+
+  nativeBuildInputs = with python3.pkgs; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    appdirs
+    charset-normalizer
+    click
+    cryptography
+    marshmallow
+    marshmallow-dataclass
+    oauthlib
+    pygitguardian
+    pyjwt
+    python-dotenv
+    pyyaml
+    requests
+    rich
+  ];
+
+  nativeCheckInputs = [
+    git
+  ] ++ (with python3.pkgs; [
+    pyfakefs
+    pytest-mock
+    pytest-voluptuous
+    pytestCheckHook
+    snapshottest
+    vcrpy
+  ]);
+
+  pythonImportsCheck = [
+    "ggshield"
+  ];
+
+  disabledTestPaths = [
+    # Don't run functional tests
+    "tests/functional/"
+  ];
+
+  disabledTests = [
+    # No TLS certificate, no .git folder, etc.
+    "test_cache_catches"
+    "test_is_git_dir"
+    "test_is_valid_git_commit_ref"
+    "test_check_git_dir"
+    "test_does_not_fail_if_cache"
+  ];
+
+  meta = with lib; {
+    description = "Tool to find and fix various types of hardcoded secrets and infrastructure-as-code misconfigurations";
+    homepage = "https://github.com/GitGuardian/ggshield";
+    changelog = "https://github.com/GitGuardian/ggshield/blob/${version}/CHANGELOG.md";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 7fdcdd20e589..95bfd3266025 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8378,6 +8378,8 @@ with pkgs;
 
   ggobi = callPackage ../tools/graphics/ggobi { };
 
+  ggshield = callPackage ../tools/security/ggshield { };
+
   ghost = callPackage ../tools/security/ghost { };
 
   ghostunnel = callPackage ../tools/networking/ghostunnel { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9e5bd99704fa..8f17e697c45e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -9036,6 +9036,8 @@ self: super: with self; {
 
   pygit2 = callPackage ../development/python-modules/pygit2 { };
 
+  pygitguardian = callPackage ../development/python-modules/pygitguardian { };
+
   pygithub = callPackage ../development/python-modules/pygithub { };
 
   pyglet = callPackage ../development/python-modules/pyglet { };
@@ -10179,6 +10181,8 @@ self: super: with self; {
 
   pytest-virtualenv = callPackage ../development/python-modules/pytest-virtualenv { };
 
+  pytest-voluptuous = callPackage ../development/python-modules/pytest-voluptuous { };
+
   pytest-warnings = callPackage ../development/python-modules/pytest-warnings { };
 
   pytest-watch = callPackage ../development/python-modules/pytest-watch { };