diff --git a/pkgs/by-name/firefox-extensions/package.nix b/pkgs/by-name/firefox-extensions/package.nix
index 31cdc90f0..24819904b 100644
--- a/pkgs/by-name/firefox-extensions/package.nix
+++ b/pkgs/by-name/firefox-extensions/package.nix
@@ -140,6 +140,7 @@ let
       i-still-dont-care-about-cookies = callPackage ./i-still-dont-care-about-cookies { };
       # open-in-mpv = callPackage ./open-in-mpv { };
       passff = callPackage ./passff { };
+      privacypass-extension = callPackage ./privacypass-extension { };
       sidebery = callPackage ./sidebery { };
 
       # ether-metamask = fetchVersionedAddon rec {
diff --git a/pkgs/by-name/firefox-extensions/privacypass-extension/default.nix b/pkgs/by-name/firefox-extensions/privacypass-extension/default.nix
new file mode 100644
index 000000000..d47e243ce
--- /dev/null
+++ b/pkgs/by-name/firefox-extensions/privacypass-extension/default.nix
@@ -0,0 +1,68 @@
+# N.B.: this package relies on a rust-based library,
+# ordinarily built via git submodule + cargo invocation.
+# TODO: build that library using Nix; otherwise, it fails to build with raw cargo
+# due to a missing cargo vendor pack.
+{
+  cargo,
+  fetchFromGitHub,
+  gitUpdater,
+  jq,
+  stdenv,
+  wasm-pack,
+  zip,
+}:
+stdenv.mkDerivation rec {
+  pname = "privacypass-extension";
+  version = "1.0.5";
+  src = fetchFromGitHub {
+    owner = "kagisearch";
+    repo = "privacypass-extension";
+    # deepClone = true;
+    fetchSubmodules = true;
+    rev = "v${version}";
+    # hash = "sha256-5ngpq0sW+Eu/yoBBwge+6U1SpAMyNlBnNfb9cSrzqQ0=";
+    # hash = "sha256-Cho2HU6GwgTQDWMSxmwDZm3oC3tiDNzvFgsRLtYGwUU=";
+    hash = "sha256-FtXX88WUWJ7AYnECsrEJB6+RqhvO3IxdYLS25f79yGc=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    jq
+    wasm-pack
+    zip
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    sh ./make.sh 1
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install build/firefox/kagi_privacypass_firefox_1.0.5.xpi $out
+
+    runHook postInstall
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+
+    # make sure we packaged all the resources needed at runtime
+    # from manifest.json's `resources` field:
+    test -f scripts/kagippjs/kagippjs.js
+    test -f scripts/kagippjs/kagippjs_bg.wasm
+
+    runHook postCheck
+  '';
+
+  doCheck = true;
+
+  passthru = {
+    extid = "privacypass@kagi.com";
+    updateScript = gitUpdater {};
+  };
+}