diff --git a/pkgs/development/python-modules/cccolutils/default.nix b/pkgs/development/python-modules/cccolutils/default.nix
index 829ebd248c41..53baa3c3e034 100644
--- a/pkgs/development/python-modules/cccolutils/default.nix
+++ b/pkgs/development/python-modules/cccolutils/default.nix
@@ -4,7 +4,7 @@
   fetchPypi,
   git,
   gitpython,
-  krb5,
+  krb5-c, # C krb5 library, not PyPI krb5
   mock,
   pytestCheckHook,
   pythonOlder,
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     hash = "sha256-YzKjG43biRbTZKtzSUHHhtzOfcZfzISHDFolqzrBjL8=";
   };
 
-  buildInputs = [ krb5 ];
+  buildInputs = [ krb5-c ];
 
   propagatedBuildInputs = [
     git
diff --git a/pkgs/development/python-modules/gssapi/default.nix b/pkgs/development/python-modules/gssapi/default.nix
index 44a7b87ec7c3..08683996db8d 100644
--- a/pkgs/development/python-modules/gssapi/default.nix
+++ b/pkgs/development/python-modules/gssapi/default.nix
@@ -7,7 +7,6 @@
 
   # build-system
   cython,
-  krb5,
   setuptools,
 
   # dependencies
@@ -15,6 +14,7 @@
 
   # native dependencies
   GSS,
+  krb5-c, # C krb5 library, not PyPI krb5
 
   # tests
   parameterized,
@@ -38,7 +38,7 @@ buildPythonPackage rec {
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace 'get_output(f"{kc} gssapi --prefix")' '"${lib.getDev krb5}"'
+      --replace 'get_output(f"{kc} gssapi --prefix")' '"${lib.getDev krb5-c}"'
   '';
 
   env = lib.optionalAttrs (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
@@ -47,7 +47,7 @@ buildPythonPackage rec {
 
   build-system = [
     cython
-    krb5
+    krb5-c
     setuptools
   ];
 
diff --git a/pkgs/development/python-modules/k5test/default.nix b/pkgs/development/python-modules/k5test/default.nix
index 676fea31f827..208f24c2b2bf 100644
--- a/pkgs/development/python-modules/k5test/default.nix
+++ b/pkgs/development/python-modules/k5test/default.nix
@@ -1,12 +1,12 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchPypi,
-  substituteAll,
   findutils,
-  krb5,
+  krb5-c,
+  pythonOlder,
   setuptools,
+  substituteAll,
 }:
 
 buildPythonPackage rec {
@@ -24,9 +24,10 @@ buildPythonPackage rec {
   patches = [
     (substituteAll {
       src = ./fix-paths.patch;
-      inherit findutils krb5;
+      inherit findutils;
+      krb5 = krb5-c;
       # krb5-config is in dev output
-      krb5Dev = krb5.dev;
+      krb5Dev = krb5-c.dev;
     })
   ];
 
diff --git a/pkgs/development/python-modules/krb5/default.nix b/pkgs/development/python-modules/krb5/default.nix
new file mode 100644
index 000000000000..ee520b0f0012
--- /dev/null
+++ b/pkgs/development/python-modules/krb5/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  cython,
+  fetchPypi,
+  k5test,
+  krb5-c, # C krb5 library
+  pytestCheckHook,
+  pythonOlder,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "krb5";
+  version = "0.6.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-cSugkvvjoo7BiCC7Gx7SzBA3t1xccDP5cMaoyXu9Egk=";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  nativeBuildInputs = [ krb5-c ];
+
+  nativeCheckInputs = [
+    k5test
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "krb5" ];
+
+  meta = with lib; {
+    changelog = "https://github.com/jborean93/pykrb5/blob/v${version}/CHANGELOG.md";
+    description = "Kerberos API bindings for Python";
+    homepage = "https://github.com/jborean93/pykrb5";
+    license = licenses.mit;
+    maintainers = teams.deshaw.members;
+  };
+}
diff --git a/pkgs/development/python-modules/pykerberos/default.nix b/pkgs/development/python-modules/pykerberos/default.nix
index b7b8953a72b3..8b8be76b12e5 100644
--- a/pkgs/development/python-modules/pykerberos/default.nix
+++ b/pkgs/development/python-modules/pykerberos/default.nix
@@ -2,7 +2,7 @@
   lib,
   fetchPypi,
   buildPythonPackage,
-  krb5,
+  krb5-c, # C krb5 library, not PyPI krb5
 }:
 
 buildPythonPackage rec {
@@ -15,12 +15,13 @@ buildPythonPackage rec {
     hash = "sha256-nXAevY/FlsmdMVXVukWBO9WQjSbvg7oK3SUO22IqvtQ=";
   };
 
-  nativeBuildInputs = [ krb5 ]; # for krb5-config
+  nativeBuildInputs = [ krb5-c ]; # for krb5-config
 
-  buildInputs = [ krb5 ];
+  buildInputs = [ krb5-c ];
 
   # there are no tests
   doCheck = false;
+
   pythonImportsCheck = [ "kerberos" ];
 
   meta = with lib; {
diff --git a/pkgs/development/python-modules/pypsrp/default.nix b/pkgs/development/python-modules/pypsrp/default.nix
index 7cf8c56581dc..faddf2906f5f 100644
--- a/pkgs/development/python-modules/pypsrp/default.nix
+++ b/pkgs/development/python-modules/pypsrp/default.nix
@@ -4,10 +4,8 @@
   buildPythonPackage,
   cryptography,
   fetchFromGitHub,
-  gssapi,
   httpcore,
   httpx,
-  krb5,
   psrpcore,
   psutil,
   pyspnego,
@@ -52,11 +50,7 @@ buildPythonPackage rec {
 
   passthru.optional-dependencies = {
     credssp = [ requests-credssp ];
-    kerberos = [
-      # pyspnego[kerberos] will have those two dependencies
-      gssapi
-      krb5
-    ];
+    kerberos = pyspnego.optional-dependencies.kerberos;
     named_pipe = [ psutil ];
     ssh = [ asyncssh ];
   };
diff --git a/pkgs/development/python-modules/requests-credssp/default.nix b/pkgs/development/python-modules/requests-credssp/default.nix
index 243332123f79..f6be7b9908f2 100644
--- a/pkgs/development/python-modules/requests-credssp/default.nix
+++ b/pkgs/development/python-modules/requests-credssp/default.nix
@@ -3,8 +3,6 @@
   buildPythonPackage,
   cryptography,
   fetchFromGitHub,
-  gssapi,
-  krb5,
   pyspnego,
   pytestCheckHook,
   pythonOlder,
@@ -34,11 +32,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [ pytestCheckHook ];
 
   passthru.optional-dependencies = {
-    kerberos = [
-      # pyspnego[kerberos] will have those two dependencies
-      gssapi
-      krb5
-    ];
+    kerberos = pyspnego.optional-dependencies.kerberos;
   };
 
   pythonImportsCheck = [ "requests_credssp" ];
diff --git a/pkgs/development/python-modules/requests-kerberos/default.nix b/pkgs/development/python-modules/requests-kerberos/default.nix
index c231233a4f29..210e792cfbf7 100644
--- a/pkgs/development/python-modules/requests-kerberos/default.nix
+++ b/pkgs/development/python-modules/requests-kerberos/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   cryptography,
   fetchFromGitHub,
-  pykerberos,
   pyspnego,
   pytest-mock,
   pytestCheckHook,
@@ -28,21 +27,14 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     cryptography
     requests
-    pykerberos
     pyspnego
-  ];
+  ] ++ pyspnego.optional-dependencies.kerberos;
 
   nativeCheckInputs = [
     pytestCheckHook
     pytest-mock
   ];
 
-  # avoid needing to package krb5
-  postPatch = ''
-    substituteInPlace setup.py \
-    --replace "pyspnego[kerberos]" "pyspnego"
-  '';
-
   pythonImportsCheck = [ "requests_kerberos" ];
 
   meta = with lib; {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4c3fb9e6b5e2..bc1d43a3ae14 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2033,7 +2033,9 @@ self: super: with self; {
 
   cbor = callPackage ../development/python-modules/cbor { };
 
-  cccolutils = callPackage ../development/python-modules/cccolutils { };
+  cccolutils = callPackage ../development/python-modules/cccolutils {
+    krb5-c = pkgs.krb5;
+  };
 
   cdcs = callPackage ../development/python-modules/cdcs { };
 
@@ -5378,8 +5380,8 @@ self: super: with self; {
   gspread = callPackage ../development/python-modules/gspread { };
 
   gssapi = callPackage ../development/python-modules/gssapi {
-    inherit (pkgs) krb5;
     inherit (pkgs.darwin.apple_sdk.frameworks) GSS;
+    krb5-c = pkgs.krb5;
   };
 
   gst-python = callPackage ../development/python-modules/gst-python {
@@ -6554,7 +6556,8 @@ self: super: with self; {
   k-diffusion = callPackage ../development/python-modules/k-diffusion { };
 
   k5test = callPackage ../development/python-modules/k5test {
-    inherit (pkgs) krb5 findutils;
+    inherit (pkgs) findutils;
+    krb5-c = pkgs.krb5;
   };
 
   kaa-base = callPackage ../development/python-modules/kaa-base { };
@@ -6703,6 +6706,10 @@ self: super: with self; {
 
   krakenex = callPackage ../development/python-modules/krakenex { };
 
+  krb5 = callPackage ../development/python-modules/krb5 {
+    krb5-c = pkgs.krb5;
+  };
+
   krfzf-py = callPackage ../development/python-modules/krfzf-py { };
 
   kserve = callPackage ../development/python-modules/kserve { };
@@ -11633,7 +11640,9 @@ self: super: with self; {
 
   pykeepass = callPackage ../development/python-modules/pykeepass { };
 
-  pykerberos = callPackage ../development/python-modules/pykerberos { };
+  pykerberos = callPackage ../development/python-modules/pykerberos {
+    krb5-c = pkgs.krb5;
+  };
 
   pykeyatome = callPackage ../development/python-modules/pykeyatome { };