diff --git a/pkgs/tools/admin/ejson2env/default.nix b/pkgs/tools/admin/ejson2env/default.nix
index 619a891ea38f..784d32b20c45 100644
--- a/pkgs/tools/admin/ejson2env/default.nix
+++ b/pkgs/tools/admin/ejson2env/default.nix
@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub, nix-update-script }:
+{ lib, buildGoModule, fetchFromGitHub, nix-update-script, testers, callPackage, ejson2env }:
 
 buildGoModule rec {
   pname = "ejson2env";
@@ -19,7 +19,13 @@ buildGoModule rec {
     "-X main.version=${version}"
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      version = testers.testVersion { package = ejson2env; };
+      decryption = callPackage ./test-decryption.nix {};
+    };
+  };
 
   meta = with lib; {
     description = "Decrypt EJSON secrets and export them as environment variables";
diff --git a/pkgs/tools/admin/ejson2env/test-decryption.nix b/pkgs/tools/admin/ejson2env/test-decryption.nix
new file mode 100644
index 000000000000..d4402a68f9d6
--- /dev/null
+++ b/pkgs/tools/admin/ejson2env/test-decryption.nix
@@ -0,0 +1,19 @@
+{ ejson2env, runCommand }:
+runCommand "check-ejson2env.sh" {
+  nativeBuildInputs = [ ejson2env ];
+} ''
+  cat > $TMP/abc.ejson <<EOF
+    {
+      "_public_key": "349a0e027725db0693cf0505344c5104807d38fb398cd4597029dccc8d0d8711",
+      "environment": {
+        "foo": "EJ[1:7oqIDkyXLro12rcrg7/psjK5Qcfuw5FRquvfBaRUBic=:OTtncVl0wT4U6UWdxoaCGBRnM2WzGnV3:1FiIgHYT5U6MjFN8IUU83T1fzQ==]"
+      }
+    }
+EOF
+  response="$(echo "ff34961809e9d7a0ae20b9d09e5d8630c8d4924cef19cdb5385916b9be019954" | ejson2env --key-from-stdin $TMP/abc.ejson)"
+  if [[ "$response" != "export foo=bar" ]]; then
+    echo "test file not decrypted correctly"
+    exit 1
+  fi
+  touch $out
+''