diff --git a/pkgs/os-specific/linux/tomb/default.nix b/pkgs/os-specific/linux/tomb/default.nix
new file mode 100644
index 000000000000..5ed7ad5b959c
--- /dev/null
+++ b/pkgs/os-specific/linux/tomb/default.nix
@@ -0,0 +1,41 @@
+{ stdenv, fetchurl, zsh, pinentry, cryptsetup, gnupg1orig, makeWrapper }:
+
+let
+    version = "2.2";
+in
+
+stdenv.mkDerivation rec {
+  name = "tomb-${version}";
+
+  src = fetchurl {
+    url = "https://files.dyne.org/tomb/tomb-${version}.tar.gz";
+    sha256 = "11msj38fdmymiqcmwq1883kjqi5zr01ybdjj58rfjjrw4zw2w5y0";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  buildPhase = ''
+    # manually patch the interpreter
+    sed -i -e "1s|.*|#!${zsh}/bin/zsh|g" tomb
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    mkdir -p $out/share/man/man1
+
+    cp tomb $out/bin/tomb
+    cp doc/tomb.1 $out/share/man/man1
+
+    wrapProgram $out/bin/tomb \
+        --prefix PATH : "${pinentry}/bin" \
+        --prefix PATH : "${cryptsetup}/bin" \
+        --prefix PATH : "${gnupg1orig}/bin"
+  '';
+
+  meta = {
+    description = "File encryption on GNU/Linux";
+    homepage = https://www.dyne.org/software/tomb/;
+    license = stdenv.lib.licenses.gpl3;
+    platforms = stdenv.lib.platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9ebd6d6960fe..f939096cc5e1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -16632,4 +16632,6 @@ in
   discord = callPackage ../applications/networking/instant-messengers/discord { };
 
   golden-cheetah = qt5.callPackage ../applications/misc/golden-cheetah {};
+
+  tomb = callPackage ../os-specific/linux/tomb {};
 }