diff --git a/pkgs/development/libraries/fortify-headers/default.nix b/pkgs/development/libraries/fortify-headers/default.nix
new file mode 100644
index 00000000000..befead87e6a
--- /dev/null
+++ b/pkgs/development/libraries/fortify-headers/default.nix
@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+stdenv.mkDerivation {
+  pname = "fortify-headers";
+  version = "1.1alpine1";
+
+  # upstream only accessible via git - unusable during bootstrap, hence
+  # extract from the alpine package
+  src = fetchurl {
+    url = "https://dl-cdn.alpinelinux.org/alpine/v3.17/main/x86_64/fortify-headers-1.1-r1.apk";
+    name = "fortify-headers.tar.gz";  # ensure it's extracted as a .tar.gz
+    hash = "sha256-A67NzUv+dldARY+MTaoVnezTg+Es8ZK/b7XOxA6KzpI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r include/fortify $out/include
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Standalone header-based fortify-source implementation";
+    homepage = "https://git.2f30.org/fortify-headers";
+    license = lib.licenses.bsd0;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ris ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4ed0ff4e5ff..9676e7e62c7 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21096,6 +21096,8 @@ with pkgs;
 
   folks = callPackage ../development/libraries/folks { };
 
+  fortify-headers = callPackage ../development/libraries/fortify-headers { };
+
   makeFontsConf = let fontconfig_ = fontconfig; in {fontconfig ? fontconfig_, fontDirectories}:
     callPackage ../development/libraries/fontconfig/make-fonts-conf.nix {
       inherit fontconfig fontDirectories;