diff --git a/pkgs/tools/misc/cf-terraforming/default.nix b/pkgs/tools/misc/cf-terraforming/default.nix
new file mode 100644
index 000000000000..fa03326ba0a0
--- /dev/null
+++ b/pkgs/tools/misc/cf-terraforming/default.nix
@@ -0,0 +1,32 @@
+{ buildGoModule, fetchFromGitHub, lib, cf-terraforming, testers }:
+
+buildGoModule rec {
+  pname = "cf-terraforming";
+  version = "0.8.5";
+
+  src = fetchFromGitHub {
+    owner = "cloudflare";
+    repo = "cf-terraforming";
+    rev = "v${version}";
+    sha256 = "1h0apmcddz1c32rlnjs81fjwpxpkz9n2zalwmk05frrgd8zdbixs";
+  };
+
+  vendorSha256 = "sha256-a/gUxW4/Kv1BuhXpwibb6u7gO8lBo250ark1kwMLToo=";
+  ldflags = [ "-X github.com/cloudflare/cf-terraforming/internal/app/cf-terraforming/cmd.versionString=${version}" ];
+
+  # The test suite insists on downloading a binary release of Terraform from
+  # Hashicorp at runtime, which isn't going to work in a nix build
+  doCheck = false;
+
+  passthru.tests = testers.testVersion {
+    package = cf-terraforming;
+    command = "cf-terraforming version";
+  };
+
+  meta = with lib; {
+    description = "A command line utility to facilitate terraforming your existing Cloudflare resources";
+    homepage = "https://github.com/cloudflare/cf-terraforming/";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ benley ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b16049c71dfb..2bfe12d0e06d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3293,6 +3293,8 @@ with pkgs;
     openssl = openssl_1_1;
   };
 
+  cf-terraforming = callPackage ../tools/misc/cf-terraforming { };
+
   charliecloud = callPackage ../applications/virtualization/charliecloud { };
 
   chelf = callPackage ../tools/misc/chelf { };