diff --git a/pkgs/development/ocaml-modules/hkdf/default.nix b/pkgs/development/ocaml-modules/hkdf/default.nix
new file mode 100644
index 000000000000..9832a5f4c41b
--- /dev/null
+++ b/pkgs/development/ocaml-modules/hkdf/default.nix
@@ -0,0 +1,26 @@
+{ lib, buildDunePackage, fetchurl, cstruct, mirage-crypto, alcotest }:
+
+buildDunePackage rec {
+  pname = "hkdf";
+  version = "1.0.4";
+
+  minimumOCamlVersion = "4.07";
+
+  src = fetchurl {
+    url = "https://github.com/hannesm/ocaml-${pname}/releases/download/v${version}/${pname}-v${version}.tbz";
+    sha256 = "0nzx6vzbc1hh6vx1ly8df4b16lgps6zjpp9mjycsnnn49bddc9mr";
+  };
+
+  useDune2 = true;
+
+  propagatedBuildInputs = [ cstruct mirage-crypto ];
+  checkInputs = [ alcotest ];
+  doCheck = true;
+
+  meta = with lib; {
+    description = "HMAC-based Extract-and-Expand Key Derivation Function (RFC 5869)";
+    homepage = "https://github.com/hannesm/ocaml-hkdf";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sternenseemann ];
+  };
+}
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4e56fd56e3e1..071d1612b6c4 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -303,6 +303,8 @@ let
 
     higlo = callPackage ../development/ocaml-modules/higlo { };
 
+    hkdf = callPackage ../development/ocaml-modules/hkdf { };
+
     hmap = callPackage ../development/ocaml-modules/hmap { };
 
     imagelib = callPackage ../development/ocaml-modules/imagelib { };