diff --git a/pkgs/tools/networking/ghostunnel/default.nix b/pkgs/tools/networking/ghostunnel/default.nix
new file mode 100644
index 000000000000..eda349e6ad62
--- /dev/null
+++ b/pkgs/tools/networking/ghostunnel/default.nix
@@ -0,0 +1,26 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+
+buildGoModule rec {
+  pname = "ghostunnel";
+  version = "1.5.3";
+
+  src = fetchFromGitHub {
+    owner = "ghostunnel";
+    repo = "ghostunnel";
+    rev = "v${version}";
+    sha256 = "15rmd89j7sfpznzznss899smizbyshprsrvsdmrbhb617myd9fpy";
+  };
+
+  vendorSha256 = "1i95fx4a0fh6id6iy6afbva4pazr7ym6sbwi9r7la6gxzyncd023";
+
+  meta = with lib; {
+    description = "A simple TLS proxy with mutual authentication support for securing non-TLS backend applications";
+    homepage = "https://github.com/ghostunnel/ghostunnel#readme";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ roberth ];
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 75705935e784..8642cf83e6f2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4855,6 +4855,8 @@ in
 
   ghorg = callPackage ../applications/version-management/git-and-tools/ghorg { };
 
+  ghostunnel = callPackage ../tools/networking/ghostunnel { };
+
   ghq = callPackage ../applications/version-management/git-and-tools/ghq { };
 
   ghr = callPackage ../applications/version-management/git-and-tools/ghr { };