diff --git a/pkgs/tools/security/kbs2/default.nix b/pkgs/tools/security/kbs2/default.nix
new file mode 100644
index 000000000000..354b28b9fa2f
--- /dev/null
+++ b/pkgs/tools/security/kbs2/default.nix
@@ -0,0 +1,42 @@
+{ stdenv, rustPlatform, fetchFromGitHub, installShellFiles, python3, libxcb, AppKit }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "kbs2";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "woodruffw";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0761g8cl9v7jj444vp83zq9f1shrddqq20pd41d5mbl6f8qpk4m5";
+  };
+
+  cargoSha256 = "0vzjkw1g6saz4nwy823dpip02jg2f21rsd8kkpra206b8i6q0mfg";
+
+  nativeBuildInputs = [ installShellFiles ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ python3 ];
+
+  buildInputs = [ ]
+    ++ stdenv.lib.optionals stdenv.isLinux [ libxcb ]
+    ++ stdenv.lib.optionals stdenv.isDarwin [ AppKit ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  checkFlagsArray = [ "--skip=kbs2::config::tests::test_find_config_dir" ];
+
+  postInstall = ''
+    for shell in bash fish zsh; do
+      $out/bin/kbs2 --completions $shell > kbs2.$shell
+      installShellCompletion kbs2.$shell
+    done
+  '';
+
+  meta = with stdenv.lib; {
+    description = "A secret manager backed by age";
+    homepage = "https://github.com/woodruffw/kbs2";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0784416273d3..3501d51363f9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4537,6 +4537,10 @@ in
 
   kbdd = callPackage ../applications/window-managers/kbdd { };
 
+  kbs2 = callPackage ../tools/security/kbs2 {
+    inherit (darwin.apple_sdk.frameworks) AppKit;
+  };
+
   kdbplus = pkgsi686Linux.callPackage ../applications/misc/kdbplus { };
 
   keepalived = callPackage ../tools/networking/keepalived { };