diff --git a/pkgs/development/libraries/gnutls/default.nix b/pkgs/development/libraries/gnutls/default.nix
index b7bdf6a4e0c1..7fa979ea7381 100644
--- a/pkgs/development/libraries/gnutls/default.nix
+++ b/pkgs/development/libraries/gnutls/default.nix
@@ -1,15 +1,31 @@
-args: with args;
+{ fetchurl, stdenv, zlib, lzo, libgcrypt
+, guileBindings, guile }:
+
+assert guileBindings -> guile != null;
+
 stdenv.mkDerivation rec {
-	name = "gnutls-2.1.5";
-	src = fetchurl {
-		url = "${meta.homepage}/releases/${name}.tar.bz2";
-		sha256 = "0idkp54d1w1c6l17pl41p2mqabcb1qm2akhfmp4mxwa5mabkiyld";
-	};
-	buildInputs = [zlib lzo libgcrypt];
+
+  name = "gnutls-2.3.4";
+
+  src = fetchurl {
+    url = "${meta.homepage}/releases/${name}.tar.bz2";
+    sha256 = "0n1pq40yl3ali17gkfzd2ad3xb9qrwx67affsqgssqffgmljq63j";
+  };
+
+  patches = [ ./tmpdir.patch ];
+
+  configurePhase = ''
+    ./configure --prefix="$out" --enable-guile --with-guile-site-dir="$out/share/guile/site"
+  '';
+
+  buildInputs = [zlib lzo libgcrypt]
+    ++ (if guileBindings then [guile] else []);
+
+  doCheck = true;
   
   meta = {
     description = "The GNU Transport Layer Security Library";
     homepage = http://www.gnu.org/software/gnutls/;
-    license = "LGPL";
+    license = "LGPLv2.1+";
   };
 }
diff --git a/pkgs/development/libraries/gnutls/tmpdir.patch b/pkgs/development/libraries/gnutls/tmpdir.patch
new file mode 100644
index 000000000000..1cd675dc5e93
--- /dev/null
+++ b/pkgs/development/libraries/gnutls/tmpdir.patch
@@ -0,0 +1,28 @@
+We disable these tests because OpenCDK's `cdk_stream_tmp_from_mem ()'
+stupidly uses `tempfile ()', which does not honor $TMPDIR, leading to
+build failures in chroots.  See also:
+
+  http://thread.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2693
+
+
+--- gnutls-2.3.4/tests/openpgp/Makefile.in	2008-03-19 13:46:02.000000000 +0100
++++ gnutls-2.3.4/tests/openpgp/Makefile.in	2008-04-08 23:21:34.000000000 +0200
+@@ -52,7 +52,7 @@ POST_UNINSTALL = :
+ build_triplet = @build@
+ host_triplet = @host@
+ target_triplet = @target@
+-@ENABLE_OPENPGP_TRUE@TESTS = keyring$(EXEEXT)
++@ENABLE_OPENPGP_TRUE@TESTS =
+ @ENABLE_OPENPGP_TRUE@check_PROGRAMS = keyring$(EXEEXT)
+ subdir = tests/openpgp
+ DIST_COMMON = $(srcdir)/Makefile.am $(srcdir)/Makefile.in
+
+--- gnutls-2.3.4/guile/tests/Makefile.in	2008-03-19 13:46:00.000000000 +0100
++++ gnutls-2.3.4/guile/tests/Makefile.in	2008-04-08 23:30:15.000000000 +0200
+@@ -524,7 +524,6 @@ top_builddir = @top_builddir@
+ top_srcdir = @top_srcdir@
+ TESTS = anonymous-auth.scm session-record-port.scm		\
+         pkcs-import-export.scm					\
+-	openpgp-keys.scm openpgp-keyring.scm openpgp-auth.scm	\
+         srp-base64.scm errors.scm				\
+ 	x509-certificates.scm x509-auth.scm
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9c05ff003bee..afefb5afa62c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2482,9 +2482,13 @@ let pkgs = rec {
     inherit (gtkLibs) glib;
   };
 
-  gnutls = import ../development/libraries/gnutls {
-    inherit fetchurl stdenv libgcrypt zlib lzo;
-  };
+  gnutls = import ../development/libraries/gnutls
+    (let guileBindings = getConfig ["gnutls" "guile"] false;
+     in {
+	 inherit fetchurl stdenv libgcrypt zlib lzo;
+	 inherit guileBindings;
+	 guile = (if guileBindings then guile else null);
+       });
 
   gpgme = import ../development/libraries/gpgme {
     inherit fetchurl stdenv libgpgerror pkgconfig pth gnupg gnupg2;