diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c1b9876237856..0766a6c9868d5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1975,6 +1975,12 @@
     githubId = 1743184;
     name = "Boris Babić";
   };
+  borlaag = {
+    email = "borlaag@proton.me";
+    github = "Borlaag";
+    githubId = 114830266;
+    name = "Børlaag";
+  };
   bosu = {
     email = "boriss@gmail.com";
     github = "bosu";
diff --git a/pkgs/development/tools/extism-cli/default.nix b/pkgs/development/tools/extism-cli/default.nix
new file mode 100644
index 0000000000000..dc96452a4175a
--- /dev/null
+++ b/pkgs/development/tools/extism-cli/default.nix
@@ -0,0 +1,37 @@
+{ lib, stdenvNoCC, fetchFromGitHub, python3, makeBinaryWrapper }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "extism-cli";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "extism";
+    repo = "cli";
+    rev = "97935786166e82154266b82410028482800e6061";
+    sha256 = "sha256-LRzXuZQt5h3exw43UXUwLVIhveYVFw/SQ2YtHI9ZnWc=";
+  };
+
+  buildInputs = [ python3 ];
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D -m 755 ./extism_cli/__init__.py "$out/bin/extism"
+
+    # The extism cli tries by default to install a library and header into /usr/local which does not work on NixOS.
+    # Pass a reasonable writable directory which can still be overwritten with another --prefix argument.
+    wrapProgram "$out/bin/extism" \
+      --add-flags '--prefix $HOME/.local'
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "The extism CLI is used to manage Extism installations";
+    homepage = "https://github.com/extism/cli";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ borlaag ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0a6560404214e..1623a08256a37 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4422,6 +4422,8 @@ with pkgs;
 
   eternal-terminal = callPackage ../tools/networking/eternal-terminal {};
 
+  extism-cli = callPackage ../development/tools/extism-cli {};
+
   extrude = callPackage ../tools/security/extrude { };
 
   fastly = callPackage ../misc/fastly {