diff --git a/pkgs/tools/backup/bakelite/default.nix b/pkgs/tools/backup/bakelite/default.nix
new file mode 100644
index 000000000000..15ddd3e2ea63
--- /dev/null
+++ b/pkgs/tools/backup/bakelite/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "bakelite";
+  version = "unstable-2021-10-19";
+
+  src = fetchFromGitHub {
+    owner = "richfelker";
+    repo = pname;
+    rev = "5fc3cf9704dbaa191b95f97d2a700588ea878a36";
+    sha256 = "xoGor8KMG1vU6hP6v6gHcADKjVpaClvkivxkcPUJtss=";
+  };
+
+  hardeningEnable = [ "pie" ];
+  buildFlags = [ "CFLAGS=-D_GNU_SOURCE" ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp bakelite $out/bin
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/richfelker/bakelite";
+    description = "Incremental backup with strong cryptographic confidentality";
+    license = licenses.gpl2;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ mvs ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d5a817bc8aa6..0d14ec586170 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -204,6 +204,8 @@ with pkgs;
 
   bacnet-stack = callPackage ../tools/networking/bacnet-stack {};
 
+  bakelite = callPackage ../tools/backup/bakelite { };
+
   breakpad = callPackage ../development/misc/breakpad { };
 
   buf = callPackage ../development/tools/buf { };