diff --git a/pkgs/development/tools/summon/default.nix b/pkgs/development/tools/summon/default.nix
new file mode 100644
index 000000000000..e01c60e3a89c
--- /dev/null
+++ b/pkgs/development/tools/summon/default.nix
@@ -0,0 +1,35 @@
+{ stdenv, buildGoModule, fetchFromGitHub, lib, patchResolver ? true }:
+
+with stdenv.lib;
+
+buildGoModule rec {
+  pname = "summon";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "cyberark";
+    repo = "summon";
+    rev = "v${version}";
+    sha256 = "1z4xnrncwvp3rfm97zvc0ivvw2fh1hrjhj3rplvidzxjfyasbvwv";
+  };
+
+  vendorSha256 = "1597vrs4b7k6gkmkvf7xnd38rvjixmlcz0j7npmik9nbkm57l74m";
+
+  subPackages = [ "cmd" ];
+
+  # Patches provider resolver to support resolving unqualified names
+  # from $PATH, e.g. `summon -p gopass` instead of `summon -p $(which gopass)`
+  patches = optional patchResolver [ ./resolve-paths.patch ];
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/summon
+  '';
+
+  meta = with lib; {
+    description =
+      "CLI that provides on-demand secrets access for common DevOps tools";
+    homepage = "https://cyberark.github.io/summon";
+    license = lib.licenses.mit;
+    maintainers = with maintainers; [ quentini ];
+  };
+}
diff --git a/pkgs/development/tools/summon/resolve-paths.patch b/pkgs/development/tools/summon/resolve-paths.patch
new file mode 100644
index 000000000000..cd49c50e2bda
--- /dev/null
+++ b/pkgs/development/tools/summon/resolve-paths.patch
@@ -0,0 +1,39 @@
+From dd34727ebfbd59738084eeb7c2a020e40a4d0abe Mon Sep 17 00:00:00 2001
+From: Quentin <Quentin Inkling>
+Date: Mon, 29 Jun 2020 17:35:04 +0300
+Subject: [PATCH] Patch for
+
+---
+ provider/provider.go | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+diff --git a/provider/provider.go b/provider/provider.go
+index c1e28d9..f20fdaa 100644
+--- a/provider/provider.go
++++ b/provider/provider.go
+@@ -78,7 +78,22 @@ func expandPath(provider string) string {
+ 	if path.Base(provider) != provider {
+ 		return provider
+ 	}
++
++	var (
++		stdOut bytes.Buffer
++		stdErr bytes.Buffer
++	)
++	cmd := exec.Command("which", provider)
++	cmd.Stdout = &stdOut
++	cmd.Stderr = &stdErr
++	err := cmd.Run()
++
++	if err == nil {
++		return strings.TrimSpace(stdOut.String())
++	}
++
+ 	return path.Join(DefaultPath, provider)
++
+ }
+ 
+ func getDefaultPath() string {
+-- 
+2.27.0
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 6c6bcecc6459..51538f25dca8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11090,6 +11090,8 @@ in
 
   strace = callPackage ../development/tools/misc/strace { };
 
+  summon = callPackage ../development/tools/summon { };
+
   swarm = callPackage ../development/tools/analysis/swarm { };
 
   swiftformat = callPackage ../development/tools/swiftformat { };