diff --git a/pkgs/os-specific/linux/shufflecake/default.nix b/pkgs/os-specific/linux/shufflecake/default.nix
new file mode 100644
index 000000000000..8e1330e56789
--- /dev/null
+++ b/pkgs/os-specific/linux/shufflecake/default.nix
@@ -0,0 +1,36 @@
+{ lib, kernel, stdenv, fetchFromGitea, libgcrypt, lvm2 }:
+stdenv.mkDerivation (finalAttrs: {
+  name = "shufflecake";
+  version = "0.4.4";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "shufflecake";
+    repo = "shufflecake-c";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-zvGHM5kajJlROI8vg1yZQ5NvJvuGLV2iKvumdW8aglA=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+  buildInputs = [ libgcrypt lvm2 ];
+  makeFlags = kernel.makeFlags ++ [
+    "KERNEL_DIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+  ];
+
+  outputs = [ "out" "bin" ];
+
+  installPhase = ''
+    install -Dm444 dm-sflc.ko $out/lib/modules/${kernel.modDirVersion}/drivers/md/dm-sflc.ko
+    install -Dm555 shufflecake $bin/shufflecake
+  '';
+
+  meta = with lib; {
+    description = "A plausible deniability (hidden storage) layer for Linux";
+    homepage = "https://shufflecake.net";
+    license = licenses.gpl2Only;
+    maintainers = with maintainers; [ oluceps ];
+    outputsToInstall = [ "bin" ];
+    platforms = platforms.linux;
+    broken = kernel.kernelOlder "6.1";
+  };
+})
+
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 26fe5c042b91..62caa91bd496 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -492,6 +492,8 @@ in {
 
     rr-zen_workaround = callPackage ../development/tools/analysis/rr/zen_workaround.nix { };
 
+    shufflecake = callPackage ../os-specific/linux/shufflecake {};
+
     sysdig = callPackage ../os-specific/linux/sysdig {};
 
     systemtap = callPackage ../development/tools/profiling/systemtap { };