diff --git a/pkgs/additional/sane-scripts/default.nix b/pkgs/additional/sane-scripts/default.nix
index e1a25a11..f44b4f8c 100644
--- a/pkgs/additional/sane-scripts/default.nix
+++ b/pkgs/additional/sane-scripts/default.nix
@@ -256,6 +256,11 @@ let
       src = ./src;
       pkgs = [ "inetutils" "systemd" ];
     };
+    ssl-dump = static-nix-shell.mkBash {
+      pname = "sane-ssl-dump";
+      src = ./src;
+      pkgs = [ "openssl" ];
+    };
   };
 in
 symlinkJoin {
diff --git a/pkgs/additional/sane-scripts/src/sane-ssl-dump b/pkgs/additional/sane-scripts/src/sane-ssl-dump
index ce20bc34..d90b79d4 100755
--- a/pkgs/additional/sane-scripts/src/sane-ssl-dump
+++ b/pkgs/additional/sane-scripts/src/sane-ssl-dump
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p openssl
 
 # dump info about the provided SSL certificate
 cert="$1"