diff --git a/pkgs/applications/window-managers/sommelier/default.nix b/pkgs/applications/window-managers/sommelier/default.nix
new file mode 100644
index 000000000000..0528553b1894
--- /dev/null
+++ b/pkgs/applications/window-managers/sommelier/default.nix
@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchzip, meson, ninja, pkg-config, wayland-scanner
+, libxkbcommon, mesa, pixman, xorg, wayland, gtest
+}:
+
+stdenv.mkDerivation {
+  pname = "sommelier";
+  version = "104.0";
+
+  src = fetchzip rec {
+    url = "https://chromium.googlesource.com/chromiumos/platform2/+archive/${passthru.rev}/vm_tools/sommelier.tar.gz";
+    passthru.rev = "af5434fd9903936a534e1316cbd22361e67949ec";
+    stripRoot = false;
+    sha256 = "LungQqHQorHIKpye2SDBLuMHPt45C1cPYcs9o5Hc3cw=";
+  };
+
+  nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
+  buildInputs = [ libxkbcommon mesa pixman wayland xorg.libxcb ];
+
+  doCheck = true;
+  checkInputs = [ gtest ];
+
+  postInstall = ''
+    rm $out/bin/sommelier_test # why does it install the test binary? o_O
+  '';
+
+  passthru.updateScript = ./update.py;
+
+  meta = with lib; {
+    homepage = "https://chromium.googlesource.com/chromiumos/platform2/+/refs/heads/main/vm_tools/sommelier/";
+    description = "Nested Wayland compositor with support for X11 forwarding";
+    maintainers = with maintainers; [ qyliss ];
+    license = licenses.bsd3;
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/applications/window-managers/sommelier/update.py b/pkgs/applications/window-managers/sommelier/update.py
new file mode 100755
index 000000000000..03898c9ccdd8
--- /dev/null
+++ b/pkgs/applications/window-managers/sommelier/update.py
@@ -0,0 +1,58 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -p common-updater-scripts python3
+#! nix-shell -i python
+
+import csv
+import json
+import re
+import shlex
+import subprocess
+from os.path import abspath, dirname, splitext
+from urllib.request import urlopen
+
+# CrOS version numbers look like this:
+# [<chrome-major-version>.]<tip-build>.<branch-build>.<branch-branch-build>
+#
+# As far as I can tell, branches are where internal Google
+# modifications are added to turn Chromium OS into Chrome OS, and
+# branch branches are used for fixes for specific devices.  So for
+# Chromium OS they will always be 0.  This is a best guess, and is not
+# documented.
+with urlopen('https://chromiumdash.appspot.com/cros/download_serving_builds_csv?deviceCategory=ChromeOS') as resp:
+    reader = csv.reader(map(bytes.decode, resp))
+    header = reader.__next__()
+    cr_stable_index = header.index('cr_stable')
+    cros_stable_index = header.index('cros_stable')
+    chrome_version = []
+    platform_version = []
+
+    for line in reader:
+        this_chrome_version = list(map(int, line[cr_stable_index].split('.')))
+        this_platform_version = list(map(int, line[cros_stable_index].split('.')))
+        chrome_version = max(chrome_version, this_chrome_version)
+        platform_version = max(platform_version, this_platform_version)
+
+chrome_major_version = chrome_version[0]
+chromeos_tip_build = platform_version[0]
+release_branch = f'release-R{chrome_major_version}-{chromeos_tip_build}.B'
+
+# Determine the git revision.
+with urlopen(f'https://chromium.googlesource.com/chromiumos/platform2/+/refs/heads/{release_branch}?format=JSON') as resp:
+    resp.readline() # Remove )]}' header
+    rev = json.load(resp)['commit']
+
+# Determine the patch version by counting the commits that have been
+# added to the release branch since it forked off the chromeos branch.
+with urlopen(f'https://chromium.googlesource.com/chromiumos/platform2/+log/refs/heads/main..{rev}/vm_tools/sommelier?format=JSON') as resp:
+    resp.readline() # Remove )]}' header
+    branch_commits = json.load(resp)['log']
+    version = f'{chrome_major_version}.{len(branch_commits)}'
+
+# Update the version, git revision, and hash in sommelier's default.nix.
+subprocess.run(['update-source-version', 'sommelier', f'--rev={rev}', version])
+
+# Find the path to sommelier's default.nix, so Cargo.lock can be written
+# into the same directory.
+argv = ['nix-instantiate', '--eval', '--json', '-A', 'sommelier.meta.position']
+position = json.loads(subprocess.check_output(argv).decode('utf-8'))
+filename = re.match(r'[^:]*', position)[0]
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2e6a1a37376a..e218ce7abb52 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -30330,6 +30330,8 @@ with pkgs;
 
   snixembed = callPackage ../applications/misc/snixembed { };
 
+  sommelier = callPackage ../applications/window-managers/sommelier { };
+
   sooperlooper = callPackage ../applications/audio/sooperlooper { };
 
   sops = callPackage ../tools/security/sops { };