diff --git a/pkgs/tools/security/donkey/default.nix b/pkgs/tools/security/donkey/default.nix
new file mode 100644
index 000000000000..8244d7f0c298
--- /dev/null
+++ b/pkgs/tools/security/donkey/default.nix
@@ -0,0 +1,54 @@
+{ stdenv
+, fetchFromGitLab
+, libmd
+, coreutils
+, lib
+, testers
+, donkey
+}:
+
+stdenv.mkDerivation rec {
+  pname = "donkey";
+  version = "1.2.0";
+
+  src = fetchFromGitLab {
+    owner = "donkey";
+    repo = "donkey";
+    rev = "tags/release/${version}";
+    hash = "sha256-2xgb9l0Eko39HJVROAWEIP3qLg5t/5h/rm2MoXoKnJI=";
+  };
+  sourceRoot = "source/src";
+
+  buildInputs = [ libmd ];
+
+  preInstall = ''
+    # don't change the owner, use global permissions:
+    export INSTALL_PROGRAM="${coreutils}/bin/install -m 555"
+    export INSTALL_DATA="${coreutils}/bin/install -m 444"
+  '';
+
+  passthru.tests.version = testers.testVersion { package = donkey; };
+
+  meta = with lib; {
+    description = "an alternative for S/KEY's 'key' command.";
+    longDescription = ''
+Donkey is an alternative for S/KEY's "key" command.  The new feature that
+the original key doesn't have is print an entry for skeykeys as
+follows;
+
+    kazu 0099 al02004          115d83956f1089b6  Apr 26,1995 22:13:27
+
+This means that donkey is also an alternative for "keyinit".  Since the
+entry is printed to stdout (not to /etc/skeykeys), you can easily send
+it to a remote operator by e-mail (with a PGP signature or something).
+So, it is possible to initiate S/KEY without logging in from the console of
+the host.
+
+The name "Donkey" is an acronym of "Don't Key".
+    '';
+    homepage = "https://devel.ringlet.net/security/donkey";
+    license = licenses.gpl2;
+    maintainers = with maintainers; [ raboof ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 61ce94cd5e94..02fef46b817b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1534,6 +1534,8 @@ with pkgs;
 
   dolbybcsoftwaredecode = callPackage ../applications/audio/dolbybcsoftwaredecode { };
 
+  donkey = callPackage ../tools/security/donkey { };
+
   dwarfs = callPackage ../tools/filesystems/dwarfs { };
 
   etlegacy = callPackage ../games/etlegacy { lua = lua5_4; };