diff --git a/lib/maintainers.nix b/lib/maintainers.nix
index a01b0215da2a..40b4c03f5879 100644
--- a/lib/maintainers.nix
+++ b/lib/maintainers.nix
@@ -345,6 +345,7 @@
   proglodyte = "Proglodyte <proglodyte23@gmail.com>";
   pshendry = "Paul Hendry <paul@pshendry.com>";
   psibi = "Sibi <sibi@psibi.in>";
+  pstn = "Philipp Steinpaß <philipp@xndr.de>";
   pSub = "Pascal Wittmann <mail@pascal-wittmann.de>";
   puffnfresh = "Brian McKenna <brian@brianmckenna.org>";
   pxc = "Patrick Callahan <patrick.callahan@latitudeengineering.com>";
diff --git a/pkgs/tools/admin/dehydrated/default.nix b/pkgs/tools/admin/dehydrated/default.nix
new file mode 100644
index 000000000000..6bd915e70508
--- /dev/null
+++ b/pkgs/tools/admin/dehydrated/default.nix
@@ -0,0 +1,31 @@
+{ stdenv, bash, coreutils, curl, diffutils, gawk, gnugrep, gnused, openssl, makeWrapper, fetchFromGitHub }:
+let
+  pkgName = "dehydrated";
+  version = "0.3.1";
+in
+stdenv.mkDerivation rec {
+  name = pkgName + "-" + version;
+
+  src = fetchFromGitHub {
+    owner = "lukas2511";
+    repo = "dehydrated";
+    rev = "v${version}";
+    sha256 = "0prg940ykbsfb4w48bc03j5abycg8v7f9rg9x3kcva37y8ml0jsp";
+  };
+
+  buildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a dehydrated $out/bin
+    wrapProgram "$out/bin/dehydrated" --prefix PATH : "${stdenv.lib.makeBinPath [ openssl coreutils gnused gnugrep diffutils curl gawk ]}"
+    '';
+
+  meta = with stdenv.lib; {
+    inherit (src.meta) homepage;
+    description = "Letsencrypt/acme client implemented as a shell-script";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = [ maintainers.pstn ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 9bbf962a45fd..dd2710a6ce7c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -774,6 +774,8 @@ in
 
   ddate = callPackage ../tools/misc/ddate { };
 
+  dehydrated = callPackage ../tools/admin/dehydrated { };
+
   deis = callPackage ../development/tools/deis {};
 
   deisctl = callPackage ../development/tools/deisctl {};