diff --git a/pkgs/applications/networking/cluster/helm/plugins/default.nix b/pkgs/applications/networking/cluster/helm/plugins/default.nix
new file mode 100644
index 000000000000..5c1a5a57d765
--- /dev/null
+++ b/pkgs/applications/networking/cluster/helm/plugins/default.nix
@@ -0,0 +1,36 @@
+{ stdenv, fetchFromGitHub, fetchurl, fetchzip }:
+let
+
+  buildHelmPlugin = { name, ... }@attrs:
+    fetchzip (attrs // {
+      stripRoot = false;
+    });
+in {
+
+  helm-s3 = let
+    pname = "helm-s3";
+    version = "0.10.0";
+  in buildHelmPlugin rec {
+    name = "${pname}-${version}";
+    url = "https://github.com/hypnoglow/helm-s3/releases/download/v${version}/helm-s3_${version}_linux_amd64.tar.gz";
+    sha256 = "sha256-pTux7HArWB5yO1Oehfd+ZpeGUziI2+wfUart5WfkQW4=";
+
+    extraPostFetch = ''
+      mkdir $out/${pname}
+      GLOBIGNORE="$out/${pname}"
+      mv $out/* -t $out/${pname}
+    '';
+  };
+
+  helm-diff = buildHelmPlugin {
+    name = "helm-diff";
+    url = "https://github.com/databus23/helm-diff/releases/download/v3.1.3/helm-diff-linux.tgz";
+    sha256 = "sha256-oGmBPcCyUgq2YD4+CkGrbf6/JhzXJjmkaiqX/3a03aE=";
+  };
+
+  helm-secrets = buildHelmPlugin {
+    name = "helm-secrets";
+    url = "https://github.com/jkroepke/helm-secrets/releases/download/v3.4.1/helm-secrets.tar.gz";
+    sha256 = "sha256-HXwbs/bXJXF75FbLB/En0jirCQnz8HpU3o9LeMyV0e8=";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/helm/wrapper.nix b/pkgs/applications/networking/cluster/helm/wrapper.nix
new file mode 100644
index 000000000000..edad7fa1bc99
--- /dev/null
+++ b/pkgs/applications/networking/cluster/helm/wrapper.nix
@@ -0,0 +1,48 @@
+{ stdenv, symlinkJoin, lib, makeWrapper
+, writeText
+}:
+
+helm:
+
+let
+  wrapper = {
+    plugins ? [],
+    extraMakeWrapperArgs ? ""
+  }:
+  let
+
+  initialMakeWrapperArgs = [
+      "${helm}/bin/helm" "${placeholder "out"}/bin/helm"
+      "--argv0" "$0" "--set" "HELM_PLUGINS" "${pluginsDir}"
+  ];
+
+  pluginsDir = symlinkJoin {
+    name = "helm-plugins";
+    paths = plugins;
+  };
+in
+  symlinkJoin {
+    name = "helm-${lib.getVersion helm}";
+
+    # Remove the symlinks created by symlinkJoin which we need to perform
+    # extra actions upon
+    postBuild = ''
+      rm $out/bin/helm
+      makeWrapper ${lib.escapeShellArgs initialMakeWrapperArgs}  ${extraMakeWrapperArgs}
+    '';
+    paths = [ helm pluginsDir ];
+
+    preferLocalBuild = true;
+
+    nativeBuildInputs = [ makeWrapper ];
+    passthru = { unwrapped = helm; };
+
+    meta = helm.meta // {
+      # To prevent builds on hydra
+      hydraPlatforms = [];
+      # prefer wrapper over the package
+      priority = (helm.meta.priority or 0) - 1;
+    };
+  };
+in
+  lib.makeOverridable wrapper
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 533855825a04..bfea34f47480 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23401,6 +23401,12 @@ in
 
   kubernetes-helm = callPackage ../applications/networking/cluster/helm { };
 
+  wrapHelm = callPackage ../applications/networking/cluster/helm/wrapper.nix { };
+
+  kubernetes-helm-wrapped = wrapHelm kubernetes-helm-unwrapped {};
+
+  kubernetes-helmPlugins = dontRecurseIntoAttrs (callPackage ../applications/networking/cluster/helm/plugins { });
+
   kubetail = callPackage ../applications/networking/cluster/kubetail { } ;
 
   kupfer = callPackage ../applications/misc/kupfer {