diff --git a/pkgs/servers/vouch-proxy/default.nix b/pkgs/servers/vouch-proxy/default.nix
new file mode 100644
index 000000000000..8badb4f8fdd9
--- /dev/null
+++ b/pkgs/servers/vouch-proxy/default.nix
@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "vouch-proxy";
+  version = "0.32.0";
+
+  src = fetchFromGitHub {
+    owner = "vouch";
+    repo = "vouch-proxy";
+    rev = "v${version}";
+    sha256 = "sha256-thA3hsGNDifUc0XFsOB8cjJTrz4NY+NtK05a20AFzJ8=";
+  };
+
+  vendorSha256 = "sha256-ifH+420FIrib+zQtzzHtMMYd84BED+vgnRw4xToYIl4=";
+
+  ldflags = [
+    "-s" "-w"
+    "-X main.version=${version}"
+  ];
+
+  preCheck = ''
+    export VOUCH_ROOT=$PWD
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/vouch/vouch-proxy";
+    description = "An SSO and OAuth / OIDC login solution for NGINX using the auth_request module";
+    license = licenses.mit;
+    maintainers = with maintainers; [ em0lar ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9c67e1e90af0..498a34c158cf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20629,6 +20629,8 @@ with pkgs;
 
   urserver = callPackage ../servers/urserver { };
 
+  vouch-proxy = callPackage ../servers/vouch-proxy { };
+
   victoriametrics = callPackage ../servers/nosql/victoriametrics { };
 
   virtlyst = libsForQt5.callPackage ../servers/web-apps/virtlyst { };