diff --git a/pkgs/additional/u-boot-pinephone-pro/default.nix b/pkgs/additional/u-boot-pinephone-pro/default.nix
new file mode 100644
index 000000000..5964cceaa
--- /dev/null
+++ b/pkgs/additional/u-boot-pinephone-pro/default.nix
@@ -0,0 +1,26 @@
+{
+  armTrustedFirmwareRK3399,
+  buildUBoot,
+}:
+
+(buildUBoot {
+  defconfig = "pinephone-pro-rk3399_defconfig";
+  filesToInstall = [
+    "u-boot"  #< ELF file
+    "u-boot.bin"  #< raw binary, load it into RAM and jump to it
+    "u-boot-rockchip.bin"
+    # "u-boot-rockchip-spi.bin"
+    # no toplevel spl, but check spl/u-boot-spl.bin
+    "u-boot.cfg"  #< copy of Kconfig which this u-boot was compiled with
+    "u-boot.dtb"
+    "u-boot.map"
+    "u-boot-nodtb.bin"
+    "u-boot.sym"
+  ];
+}).overrideAttrs (base: {
+  env = (base.env or {}) // {
+    # XXX: RK3399 ships a blob for HDCP (media copy protection) in the trusted firmware.
+    #      that can be removed with `unfreeIncludeHDCPBlob = false`, if so desired.
+    BL31 = "${armTrustedFirmwareRK3399}/bl31.elf";
+  };
+})
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 9bde0842b..d003af5b2 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -122,6 +122,7 @@ let
     tree-sitter-nix-shell = callPackage ./additional/tree-sitter-nix-shell { };
     trivial-builders = lib.recurseIntoAttrs (callPackage ./additional/trivial-builders { });
     u-boot-pinephone = callPackage ./additional/u-boot-pinephone { };
+    u-boot-pinephone-pro = callPackage ./additional/u-boot-pinephone-pro { };
     uassets = callPackage ./additional/uassets { };
     uninsane-dot-org = callPackage ./additional/uninsane-dot-org { };
     wvkbd-mk = callPackage ./additional/wvkbd-mk { };