diff --git a/pkgs/browserpass-extension/default.nix b/pkgs/browserpass-extension/default.nix
new file mode 100644
index 00000000..cb16a310
--- /dev/null
+++ b/pkgs/browserpass-extension/default.nix
@@ -0,0 +1,57 @@
+{ stdenv
+, fetchFromGitHub
+, gnused
+, jq
+, mkYarnModules
+, zip
+}:
+
+let
+  pname = "browserpass-extension";
+  version = "3.7.2";
+  src = fetchFromGitHub {
+    owner = "browserpass";
+    repo = "browserpass-extension";
+    rev = version;
+    sha256 = "sha256-uDJ0ID8mD+5WLQK40+OfzRNIOOhZWsLYIi6QgcdIDvc=";
+  };
+  browserpass-extension-yarn-modules = mkYarnModules {
+    inherit pname version;
+    packageJSON = "${src}/src/package.json";
+    yarnLock = "${src}/src/yarn.lock";
+  };
+  extid = "browserpass@maximbaz.com";
+in stdenv.mkDerivation {
+  inherit pname version src;
+
+  patchPhase = ''
+    # dependencies are built separately: skip the yarn install
+    ${gnused}/bin/sed -i /yarn\ install/d src/Makefile
+  '';
+
+  preBuild = ''
+    ln -s ${browserpass-extension-yarn-modules}/node_modules src/node_modules
+  '';
+
+  installPhase = ''
+    BASE=$out/share/mozilla/extensions/\{ec8030f7-c20a-464f-9b0e-13a3a9e97384\}
+    mkdir -p $BASE
+
+    pushd firefox
+
+    # firefox requires addons to have an id field when sideloading:
+    # - <https://extensionworkshop.com/documentation/publish/distribute-sideloading/>
+    cat manifest.json \
+      | ${jq}/bin/jq '. + { applications: {gecko: {id: "${extid}" }}, browser_specific_settings: {gecko: {id: "${extid}"}} }' \
+      > manifest.patched.json
+    mv manifest{.patched,}.json
+
+    ${zip}/bin/zip -r $BASE/browserpass@maximbaz.com.xpi ./*
+
+    popd
+  '';
+
+  passthru = {
+    inherit extid;
+  };
+}
diff --git a/pkgs/overlay.nix b/pkgs/overlay.nix
index 4bc57075..6ad90cd6 100644
--- a/pkgs/overlay.nix
+++ b/pkgs/overlay.nix
@@ -42,6 +42,7 @@
   #### TEMPORARY: PACKAGES WAITING TO BE UPSTREAMED
   kaiteki = prev.callPackage ./kaiteki { };
   lightdm-mobile-greeter = prev.callPackage ./lightdm-mobile-greeter { pkgs = next; };
+  browserpass-extension = prev.callPackage ./browserpass-extension { };
   gopass-native-messaging-host = prev.callPackage ./gopass-native-messaging-host { };
   # kaiteki = prev.kaiteki;
   # TODO: upstream, or delete nabla