diff --git a/nixos/modules/services/misc/matrix-synapse.nix b/nixos/modules/services/misc/matrix-synapse.nix
index 703bc9416f88..8ed4bbdd031c 100644
--- a/nixos/modules/services/misc/matrix-synapse.nix
+++ b/nixos/modules/services/misc/matrix-synapse.nix
@@ -9,6 +9,9 @@ let
   logConfigFile = pkgs.writeText "log_config.yaml" cfg.logConfig;
   mkResource = r: ''{names: ${builtins.toJSON r.names}, compress: ${boolToString r.compress}}'';
   mkListener = l: ''{port: ${toString l.port}, bind_address: "${l.bind_address}", type: ${l.type}, tls: ${boolToString l.tls}, x_forwarded: ${boolToString l.x_forwarded}, resources: [${concatStringsSep "," (map mkResource l.resources)}]}'';
+  pluginsEnv = cfg.package.python.buildEnv.override {
+    extraLibs = cfg.plugins;
+  };
   configFile = pkgs.writeText "homeserver.yaml" ''
 ${optionalString (cfg.tls_certificate_path != null) ''
 tls_certificate_path: "${cfg.tls_certificate_path}"
@@ -125,6 +128,14 @@ in {
           Overridable attribute of the matrix synapse server package to use.
         '';
       };
+      plugins = mkOption {
+        type = types.listOf types.package;
+        default = [ ];
+        defaultText = "with config.services.matrix-synapse.package.plugins [ matrix-synapse-ldap3 matrix-synapse-pam ]";
+        description = ''
+          List of additional Matrix plugins to make available.
+        '';
+      };
       no_tls = mkOption {
         type = types.bool;
         default = false;
@@ -686,6 +697,7 @@ in {
           --keys-directory ${cfg.dataDir} \
           --generate-keys
       '';
+      environment.PYTHONPATH = makeSearchPathOutput "lib" cfg.package.python.sitePackages [ pluginsEnv ];
       serviceConfig = {
         Type = "notify";
         User = "matrix-synapse";
diff --git a/pkgs/development/python-modules/python-pam/default.nix b/pkgs/development/python-modules/python-pam/default.nix
new file mode 100644
index 000000000000..4065cd7c0145
--- /dev/null
+++ b/pkgs/development/python-modules/python-pam/default.nix
@@ -0,0 +1,23 @@
+{ stdenv, buildPythonPackage, fetchPypi, pam }:
+
+buildPythonPackage rec {
+  pname = "python-pam";
+  version = "1.8.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "16whhc0vr7gxsbzvsnq65nq8fs3wwmx755cavm8kkczdkz4djmn8";
+  };
+
+  postPatch = ''
+    substituteInPlace pam.py --replace 'find_library("pam")' \
+      '"${pam}/lib/libpam${stdenv.hostPlatform.extensions.sharedLibrary}"'
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Python PAM module using ctypes";
+    homepage = "https://github.com/FirefighterBlu3/python-pam";
+    maintainers = with maintainers; [ abbradar ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/servers/matrix-synapse/default.nix b/pkgs/servers/matrix-synapse/default.nix
index d2c1afa0e7ca..15df735b7072 100644
--- a/pkgs/servers/matrix-synapse/default.nix
+++ b/pkgs/servers/matrix-synapse/default.nix
@@ -5,23 +5,9 @@
 with python3.pkgs;
 
 let
-  matrix-synapse-ldap3 = buildPythonPackage rec {
-    pname = "matrix-synapse-ldap3";
-    version = "0.1.4";
-
-    src = fetchPypi {
-      inherit pname version;
-      sha256 = "01bms89sl16nyh9f141idsz4mnhxvjrc3gj721wxh1fhikps0djx";
-    };
-
-    propagatedBuildInputs = [ service-identity ldap3 twisted ];
-
-    # ldaptor is not ready for py3 yet
-    doCheck = !isPy3k;
-    checkInputs = [ ldaptor mock ];
-  };
-
-in buildPythonApplication rec {
+  plugins = python3.pkgs.callPackage ./plugins { };
+in
+buildPythonApplication rec {
   pname = "matrix-synapse";
   version = "1.14.0";
 
@@ -45,7 +31,6 @@ in buildPythonApplication rec {
     jinja2
     jsonschema
     lxml
-    matrix-synapse-ldap3
     msgpack
     netaddr
     phonenumbers
@@ -79,12 +64,14 @@ in buildPythonApplication rec {
 
   doCheck = !stdenv.isDarwin;
 
-  passthru.tests = { inherit (nixosTests) matrix-synapse; };
-
   checkPhase = ''
     PYTHONPATH=".:$PYTHONPATH" ${python3.interpreter} -m twisted.trial tests
   '';
 
+  passthru.tests = { inherit (nixosTests) matrix-synapse; };
+  passthru.plugins = plugins;
+  passthru.python = python3;
+
   meta = with stdenv.lib; {
     homepage = "https://matrix.org";
     description = "Matrix reference homeserver";
diff --git a/pkgs/servers/matrix-synapse/plugins/default.nix b/pkgs/servers/matrix-synapse/plugins/default.nix
new file mode 100644
index 000000000000..f3dbaa1573f0
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/plugins/default.nix
@@ -0,0 +1,6 @@
+{ callPackage }:
+
+{
+  matrix-synapse-ldap3 = callPackage ./ldap3.nix { };
+  matrix-synapse-pam = callPackage ./pam.nix { };
+}
diff --git a/pkgs/servers/matrix-synapse/plugins/ldap3.nix b/pkgs/servers/matrix-synapse/plugins/ldap3.nix
new file mode 100644
index 000000000000..9f1aec20033b
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/plugins/ldap3.nix
@@ -0,0 +1,17 @@
+{ isPy3k, buildPythonPackage, fetchPypi, service-identity, ldap3, twisted, ldaptor, mock }:
+
+buildPythonPackage rec {
+  pname = "matrix-synapse-ldap3";
+  version = "0.1.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "01bms89sl16nyh9f141idsz4mnhxvjrc3gj721wxh1fhikps0djx";
+  };
+
+  propagatedBuildInputs = [ service-identity ldap3 twisted ];
+
+  # ldaptor is not ready for py3 yet
+  doCheck = !isPy3k;
+  checkInputs = [ ldaptor mock ];
+}
diff --git a/pkgs/servers/matrix-synapse/plugins/pam.nix b/pkgs/servers/matrix-synapse/plugins/pam.nix
new file mode 100644
index 000000000000..47ee28a7794c
--- /dev/null
+++ b/pkgs/servers/matrix-synapse/plugins/pam.nix
@@ -0,0 +1,15 @@
+{ buildPythonPackage, fetchFromGitHub, twisted, python-pam }:
+
+buildPythonPackage rec {
+  pname = "matrix-synapse-pam";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "14mRh4X0r";
+    repo = "matrix-synapse-pam";
+    rev = "v${version}";
+    sha256 = "10byma9hxz3g4sirw5sa4pvljn83h9vs7zc15chhpl2n14bdx45l";
+  };
+
+  propagatedBuildInputs = [ twisted python-pam ];
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 045a11b7d65e..ca1e95788cff 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4692,6 +4692,8 @@ in
     (https://github.com/NixOS/nixpkgs/issues/76093) */
   matrix-synapse = callPackage ../servers/matrix-synapse { /*python3 = python38;*/ };
 
+  matrix-synapse-plugins = recurseIntoAttrs matrix-synapse.plugins;
+
   matrix-appservice-slack = callPackage ../servers/matrix-synapse/matrix-appservice-slack {};
 
   matrix-appservice-discord = callPackage ../servers/matrix-appservice-discord { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8a376a5abcbb..0aa27ff933ea 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3322,6 +3322,8 @@ in {
 
   python-axolotl-curve25519 = callPackage ../development/python-modules/python-axolotl-curve25519 { };
 
+  python-pam = callPackage ../development/python-modules/python-pam { };
+
   pythonix = callPackage ../development/python-modules/pythonix {
     inherit (pkgs) meson pkgconfig;
   };