diff --git a/pkgs/development/python-modules/pykcs11/default.nix b/pkgs/development/python-modules/pykcs11/default.nix
new file mode 100644
index 000000000000..5700fd4523a6
--- /dev/null
+++ b/pkgs/development/python-modules/pykcs11/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  callPackage,
+  fetchPypi,
+  setuptools,
+  swig4,
+}:
+
+buildPythonPackage rec {
+  pname = "pykcs11";
+  version = "1.5.16";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-Q9dGsGd/Q8xjS598Tastm6axqDuTHiWYJHBi+P9kHgc=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeBuildInputs = [ swig4 ];
+
+  pypaBuildFlags = [ "--skip-dependency-check" ];
+
+  outputs = [
+    "out"
+    "testout"
+  ];
+
+  postInstall = ''
+    mkdir $testout
+    cp -R test $testout/test
+  '';
+
+  pythonImportsCheck = [ "PyKCS11" ];
+
+  doCheck = false;
+
+  # tests complain about circular import, do testing with passthru.tests instead
+  passthru.tests = {
+    pytest = callPackage ./tests.nix { };
+  };
+
+  meta = with lib; {
+    description = "PKCS#11 wrapper for Python";
+    homepage = "https://github.com/LudovicRousseau/PyKCS11";
+    changelog = "https://github.com/LudovicRousseau/PyKCS11/releases/tag/${version}";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ hulr ];
+  };
+}
diff --git a/pkgs/development/python-modules/pykcs11/tests.nix b/pkgs/development/python-modules/pykcs11/tests.nix
new file mode 100644
index 000000000000..00468733ae30
--- /dev/null
+++ b/pkgs/development/python-modules/pykcs11/tests.nix
@@ -0,0 +1,33 @@
+{
+  buildPythonPackage,
+  asn1crypto,
+  pykcs11,
+  pytestCheckHook,
+  softhsm,
+}:
+
+buildPythonPackage {
+  pname = "pykcs11-tests";
+  inherit (pykcs11) version;
+  format = "other";
+
+  src = pykcs11.testout;
+
+  dontBuild = true;
+  dontInstall = true;
+
+  nativeCheckInputs = [
+    asn1crypto
+    pykcs11
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+    export PYKCS11LIB=${softhsm}/lib/softhsm/libsofthsm2.so
+    export SOFTHSM2_CONF=$HOME/softhsm2.conf
+    echo "directories.tokendir = $HOME/tokens" > $HOME/softhsm2.conf
+    mkdir $HOME/tokens
+    ${softhsm}/bin/softhsm2-util --init-token --label "A token" --pin 1234 --so-pin 123456 --slot 0
+  '';
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ce3728ea525a..1281e670d7d6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10399,6 +10399,8 @@ self: super: with self; {
 
   pyixapi = callPackage ../development/python-modules/pyixapi { };
 
+  pykcs11 = callPackage ../development/python-modules/pykcs11 { };
+
   pykrakenapi = callPackage ../development/python-modules/pykrakenapi { };
 
   pylance = callPackage ../development/python-modules/pylance { };