diff --git a/pkgs/by-name/ag/age/package.nix b/pkgs/by-name/ag/age/package.nix
index da7380a91475..91c368133fc2 100644
--- a/pkgs/by-name/ag/age/package.nix
+++ b/pkgs/by-name/ag/age/package.nix
@@ -3,16 +3,22 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  age-plugin-tpm,
+  age-plugin-ledger,
+  age-plugin-yubikey,
+  age-plugin-fido2-hmac,
+  makeWrapper,
+  runCommand,
 }:
 
-buildGoModule rec {
+buildGoModule (final: {
   pname = "age";
   version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "age";
-    rev = "v${version}";
+    rev = "v${final.version}";
     hash = "sha256-9ZJdrmqBj43zSvStt0r25wjSfnvitdx3GYtM3urHcaA=";
   };
 
@@ -21,10 +27,12 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.Version=${version}"
+    "-X main.Version=${final.version}"
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+  ];
 
   preInstall = ''
     installManPage doc/*.1
@@ -32,10 +40,10 @@ buildGoModule rec {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    if [[ "$("$out/bin/${pname}" --version)" == "${version}" ]]; then
-      echo '${pname} smoke check passed'
+    if [[ "$("$out/bin/${final.pname}" --version)" == "${final.version}" ]]; then
+      echo '${final.pname} smoke check passed'
     else
-      echo '${pname} smoke check failed'
+      echo '${final.pname} smoke check failed'
       return 1
     fi
   '';
@@ -46,12 +54,34 @@ buildGoModule rec {
     "TestScript/plugin"
   ];
 
+  # group age plugins together
+  passthru.plugins = {
+    inherit
+      age-plugin-tpm
+      age-plugin-ledger
+      age-plugin-yubikey
+      age-plugin-fido2-hmac
+      ;
+  };
+
+  # convenience function for wrapping sops with plugins
+  passthru.withPlugins =
+    filter:
+    runCommand "age-${final.version}-with-plugins"
+      {
+        nativeBuildInputs = [ makeWrapper ];
+      }
+      ''
+        makeWrapper ${lib.getBin final.finalPackage}/bin/age $out/bin/age \
+          --prefix PATH : "${lib.makeBinPath (filter final.passthru.plugins)}"
+      '';
+
   meta = with lib; {
-    changelog = "https://github.com/FiloSottile/age/releases/tag/v${version}";
+    changelog = "https://github.com/FiloSottile/age/releases/tag/v${final.version}";
     homepage = "https://age-encryption.org/";
     description = "Modern encryption tool with small explicit keys";
     license = licenses.bsd3;
     mainProgram = "age";
     maintainers = with maintainers; [ tazjin ];
   };
-}
+})