diff --git a/flake.nix b/flake.nix
index 4741a93..d0bdecd 100644
--- a/flake.nix
+++ b/flake.nix
@@ -9,11 +9,15 @@
       commitShaShort = if self ? rev then (pkgs.lib.substring 0 10 self.rev) else self.dirtyShortRev;
     in rec {
       packages.hagrid = pkgs.callPackage ./. { inherit commitShaShort; };
+      packages.hagridctl = pkgs.callPackage ./hagridctl.nix { };
       packages.wkdDomainChecker = pkgs.callPackage ./wkd-domain-checker/. { };
 
       packages.default = packages.hagrid;
     }) // {
-      overlays.hagrid = (final: prev: { hagrid = self.packages."${final.system}".hagrid; });
+      overlays.hagrid = (final: prev: {
+        hagrid = self.packages."${final.system}".hagrid;
+        hagridctl = self.packages."${final.system}".hagridctl;
+      });
       overlays.wkdDomainChecker = (final: prev: { wkdDomainChecker = self.packages."${final.system}".wkdDomainChecker; });
 
       overlays.default = self.overlays.hagrid;
diff --git a/hagridctl.nix b/hagridctl.nix
new file mode 100644
index 0000000..53564a8
--- /dev/null
+++ b/hagridctl.nix
@@ -0,0 +1,36 @@
+{ lib, rustPlatform, sqlite, openssl, gettext, pkg-config, commitShaShort ? "" }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "hagridctl";
+  version = "0.1.0";
+
+  src = ./.;
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "rocket_i18n-0.5.0" = "sha256-EbUE8Z3TQBnDnptl9qWK6JvsACCgP7EXTxcA7pouYbc=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    gettext
+  ];
+
+  buildInputs = [
+    sqlite
+    openssl
+  ];
+
+  buildAndTestSubdir = "hagridctl";
+
+  COMMIT_SHA_SHORT = commitShaShort;
+
+  meta = with lib; {
+    description = "A verifying keyserver";
+    homepage = "https://gitlab.com/keys.openpgp.org/hagrid";
+    license = with licenses; [ gpl3 ];
+    maintainers = with maintainers; [ valodim ];
+    platforms = platforms.all;
+  };
+}