diff --git a/pkgs/development/python-modules/ots-python/0001-use-packaged-ots.patch b/pkgs/development/python-modules/ots-python/0001-use-packaged-ots.patch
new file mode 100644
index 000000000000..233e97d7b4b8
--- /dev/null
+++ b/pkgs/development/python-modules/ots-python/0001-use-packaged-ots.patch
@@ -0,0 +1,34 @@
+From 6ba3b97253cf540fdf4b36672f290def72386096 Mon Sep 17 00:00:00 2001
+From: Dan Callaghan <djc@djc.id.au>
+Date: Sun, 23 Apr 2023 21:26:53 +1000
+Subject: [PATCH] use packaged ots
+
+
+diff --git a/setup.py b/setup.py
+index 6c3ccae..ca021da 100755
+--- a/setup.py
++++ b/setup.py
+@@ -248,7 +248,6 @@ def run(self):
+     platforms=["posix", "nt"],
+     package_dir={"": "src/python"},
+     packages=find_packages("src/python"),
+-    ext_modules=[ots_sanitize],
+     zip_safe=False,
+     cmdclass=cmdclass,
+     setup_requires=["setuptools_scm"],
+diff --git a/src/python/ots/__init__.py b/src/python/ots/__init__.py
+index 5fc1724..db9d21e 100644
+--- a/src/python/ots/__init__.py
++++ b/src/python/ots/__init__.py
+@@ -3,7 +3,7 @@
+ import sys
+ import os
+ 
+-OTS_SANITIZE = os.path.join(os.path.dirname(__file__), "ots-sanitize")
++OTS_SANITIZE = "@ots_sanitize@"
+ 
+ __all__ = ["sanitize", "OTSError", "CalledProcessError"]
+ 
+-- 
+2.38.4
+
diff --git a/pkgs/development/python-modules/ots-python/default.nix b/pkgs/development/python-modules/ots-python/default.nix
new file mode 100644
index 000000000000..32863e2e4bd3
--- /dev/null
+++ b/pkgs/development/python-modules/ots-python/default.nix
@@ -0,0 +1,48 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, substituteAll
+, opentype-sanitizer
+, setuptools-scm
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "ots-python";
+  version = "9.1.0";
+
+  src = fetchPypi {
+    pname = "opentype-sanitizer";
+    inherit version;
+    hash = "sha256-1Zdd+eRECimZl8L8CCkm7pCjN0TafSsc5i2Y6/oH88I=";
+  };
+
+  patches = [
+    # Invoke ots-sanitize from the opentype-sanitizer package instead of
+    # downloading precompiled binaries from the internet.
+    # (nixpkgs-specific, not upstreamable)
+    (substituteAll {
+      src = ./0001-use-packaged-ots.patch;
+      ots_sanitize = "${opentype-sanitizer}/bin/ots-sanitize";
+    })
+  ];
+
+  propagatedBuildInputs = [
+    opentype-sanitizer
+  ];
+  nativeBuildInputs = [
+    setuptools-scm
+  ];
+
+  doCheck = true;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Python wrapper for ots (OpenType Sanitizer)";
+    homepage = "https://github.com/googlefonts/ots-python";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ danc86 ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 78c11a9dd6e3..e60a39a032b1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8735,6 +8735,8 @@ self: super: with self; {
 
   ossfs = callPackage ../development/python-modules/ossfs { };
 
+  ots-python = callPackage ../development/python-modules/ots-python { };
+
   outcome = callPackage ../development/python-modules/outcome { };
 
   ovh = callPackage ../development/python-modules/ovh { };