diff --git a/pkgs/applications/version-management/monotone/botan2.nix b/pkgs/applications/version-management/monotone/botan2.nix
new file mode 100644
index 000000000000..616dffa0adbe
--- /dev/null
+++ b/pkgs/applications/version-management/monotone/botan2.nix
@@ -0,0 +1,104 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  pkgsStatic,
+  python3,
+  docutils,
+  bzip2,
+  zlib,
+  darwin,
+  static ? stdenv.hostPlatform.isStatic, # generates static libraries *only*
+  enableForMonotone ? false, # Is it being imported for Monotone use?
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "botan";
+  version = "2.19.5";
+
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+  strictDeps = true;
+
+  outputs = [
+    "bin"
+    "out"
+    "dev"
+    "doc"
+    "man"
+  ];
+
+  src = fetchurl {
+    url = "http://botan.randombit.net/releases/Botan-${finalAttrs.version}.tar.xz";
+    hash = "sha256-3+6g4KbybWckxK8B2pp7iEh62y2Bunxy/K9S21IsmtQ=";
+  };
+
+  nativeBuildInputs = [
+    python3
+    docutils
+  ];
+
+  buildInputs = [
+    bzip2
+    zlib
+  ];
+
+  buildTargets = [
+    "cli"
+  ]
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [ "tests" ]
+  ++ lib.optionals static [ "static" ]
+  ++ lib.optionals (!static) [ "shared" ];
+
+  botanConfigureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--bindir=${placeholder "bin"}/bin"
+    "--docdir=${placeholder "doc"}/share/doc"
+    "--mandir=${placeholder "man"}/share/man"
+    "--no-install-python-module"
+    "--build-targets=${lib.concatStringsSep "," finalAttrs.buildTargets}"
+    "--with-bzip2"
+    "--with-zlib"
+    "--with-rst2man"
+    "--cpu=${stdenv.hostPlatform.parsed.cpu.name}"
+  ]
+  ++ lib.optionals stdenv.cc.isClang [
+    "--cc=clang"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isMinGW) [
+    "--os=mingw"
+  ];
+
+  configurePhase = ''
+    runHook preConfigure
+    python configure.py ''${botanConfigureFlags[@]}
+    runHook postConfigure
+  '';
+
+  preInstall = ''
+    if [ -d src/scripts ]; then
+      patchShebangs src/scripts
+    fi
+  '';
+
+  postInstall = ''
+    cd "$out"/lib/pkgconfig
+    ln -s botan-*.pc botan.pc || true
+  '';
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Cryptographic algorithms library";
+    homepage = "https://botan.randombit.net";
+    mainProgram = "botan";
+    maintainers = with maintainers; [
+      raskin
+    ];
+    platforms = platforms.unix;
+    license = licenses.bsd2;
+    knownVulnerabilities = lib.optional (
+      !enableForMonotone
+    ) "Botan2 is EOL and its full interface surface contains unpatched vulnerabilities";
+  };
+})
diff --git a/pkgs/applications/version-management/monotone/default.nix b/pkgs/applications/version-management/monotone/default.nix
index b72173aef2fd..0d2b3537dfaa 100644
--- a/pkgs/applications/version-management/monotone/default.nix
+++ b/pkgs/applications/version-management/monotone/default.nix
@@ -4,7 +4,6 @@
   fetchFromGitHub,
   boost,
   zlib,
-  botan2,
   libidn,
   lua,
   pcre,
@@ -19,11 +18,14 @@
   autoreconfHook,
   texinfo,
   fetchpatch,
+  callPackage,
 }:
 
 let
   version = "1.1-unstable-2021-05-01";
   perlVersion = lib.getVersion perl;
+
+  botan = callPackage ./botan2.nix { enableForMonotone = true; };
 in
 
 assert perlVersion != "";
@@ -79,7 +81,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     boost
     zlib
-    botan2
+    botan
     libidn
     lua
     pcre