diff --git a/pkgs/servers/keycloak/all-plugins.nix b/pkgs/servers/keycloak/all-plugins.nix
index f1e08dd46df9..f2f1117f2d84 100644
--- a/pkgs/servers/keycloak/all-plugins.nix
+++ b/pkgs/servers/keycloak/all-plugins.nix
@@ -5,4 +5,5 @@
   scim-keycloak-user-storage-spi = callPackage ./scim-keycloak-user-storage-spi {};
   keycloak-discord = callPackage ./keycloak-discord {};
   keycloak-metrics-spi = callPackage ./keycloak-metrics-spi {};
+  keycloak-restrict-client-auth = callPackage ./keycloak-restrict-client-auth {};
 }
diff --git a/pkgs/servers/keycloak/keycloak-restrict-client-auth/default.nix b/pkgs/servers/keycloak/keycloak-restrict-client-auth/default.nix
new file mode 100644
index 000000000000..bf5d38bca013
--- /dev/null
+++ b/pkgs/servers/keycloak/keycloak-restrict-client-auth/default.nix
@@ -0,0 +1,28 @@
+{ maven, lib, fetchFromGitHub }:
+
+maven.buildMavenPackage rec {
+  pname = "keycloak-restrict-client-auth";
+  version = "23.0.0";
+
+  src = fetchFromGitHub {
+    owner = "sventorben";
+    repo = "keycloak-restrict-client-auth";
+    rev = "v${version}";
+    hash = "sha256-JA3DvLdBKyn2VE1pYSCcRV9Cl7ZAWsRG5MAp548Rl+g=";
+  };
+
+  mvnHash = "sha256-W1YvX1P/mshGYoTUO5XMlOcpu2KiujwLludaC3miak4=";
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm444 -t "$out" target/keycloak-restrict-client-auth.jar
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/sventorben/keycloak-restrict-client-auth";
+    description = "A Keycloak authenticator to restrict authorization on clients";
+    license = licenses.mit;
+    maintainers = with maintainers; [ leona ];
+  };
+}