diff --git a/pkgs/tools/security/mokutil/default.nix b/pkgs/tools/security/mokutil/default.nix
new file mode 100644
index 000000000000..a84763a242ff
--- /dev/null
+++ b/pkgs/tools/security/mokutil/default.nix
@@ -0,0 +1,40 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, openssl
+, efivar
+, keyutils
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mokutil";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "lcp";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-dt41TCr6RkmE9H+NN8LWv3ogGsK38JtLjVN/b2mbGJs=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    efivar
+    keyutils
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/lcp/mokutil";
+    description = "Utility to manipulate machines owner keys";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ nickcao ];
+    platforms = platforms.linux;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a298c48a3605..0e470e437d49 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -774,6 +774,8 @@ with pkgs;
   mkShell = callPackage ../build-support/mkshell { };
   mkShellNoCC = mkShell.override { stdenv = stdenvNoCC; };
 
+  mokutil = callPackage ../tools/security/mokutil { };
+
   nixBufferBuilders = import ../build-support/emacs/buffer.nix { inherit lib writeText; inherit (emacs.pkgs) inherit-local; };
 
   nix-gitignore = callPackage ../build-support/nix-gitignore { };