diff --git a/pkgs/development/python-modules/python-pae/default.nix b/pkgs/development/python-modules/python-pae/default.nix
new file mode 100644
index 00000000000..067d2a2843e
--- /dev/null
+++ b/pkgs/development/python-modules/python-pae/default.nix
@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, poetry-core
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "python-pae";
+  version = "0.1.0";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
+
+  # Tests are on GitHub
+  src = fetchFromGitHub {
+    owner = "MatthiasValvekens";
+    repo = "python-pae";
+    rev = version;
+    sha256 = "sha256-D0X2T0ze79KR6Gno4UWpA/XvlkK6Y/jXUtLbzlOKr3E=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "python_pae" ];
+
+  meta = with lib; {
+    description = "Pre-authentication encoding (PAE) implementation in Python";
+    homepage = "https://github.com/MatthiasValvekens/python-pae";
+    license = licenses.mit;
+    maintainers = with maintainers; [ wolfangaukang ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 04afc93babb..e0b07a3274a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8321,6 +8321,8 @@ in {
 
   python-packer = callPackage ../development/python-modules/python-packer { };
 
+  python-pae = callPackage ../development/python-modules/python-pae { };
+
   python-pam = callPackage ../development/python-modules/python-pam {
     inherit (pkgs) pam;
   };