diff --git a/pkgs/misc/arm-trusted-firmware/default.nix b/pkgs/misc/arm-trusted-firmware/default.nix
new file mode 100644
index 000000000000..fdaf109ebffe
--- /dev/null
+++ b/pkgs/misc/arm-trusted-firmware/default.nix
@@ -0,0 +1,63 @@
+{ stdenv, fetchFromGitHub, buildPackages }:
+
+let
+  buildArmTrustedFirmware = { targetPlatforms
+            , filesToInstall
+            , installDir ? "$out"
+            , platform
+            , extraMakeFlags ? []
+            , extraMeta ? {}
+            , ... } @ args:
+           stdenv.mkDerivation (rec {
+
+    name = "arm-trusted-firmware-${platform}-${version}";
+    version = "1.4";
+
+    src = fetchFromGitHub {
+      owner = "ARM-software";
+      repo = "arm-trusted-firmware";
+      rev = "b762fc7481c66b64eb98b6ff694d569e66253973";
+      sha256 = "15m10dfgqkgw6rmzgfg1xzp1si9d5jwzyrcb7cp3y9ckj6mvp3i3";
+    };
+
+    depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+    makeFlags = [
+      "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
+      "PLAT=${platform}"
+    ] ++ extraMakeFlags;
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p ${installDir}
+      cp ${stdenv.lib.concatStringsSep " " filesToInstall} ${installDir}
+
+      runHook postInstall
+    '';
+
+    hardeningDisable = [ "all" ];
+    dontStrip = true;
+
+    enableParallelBuilding = true;
+
+    meta = with stdenv.lib; {
+      homepage = https://github.com/ARM-software/arm-trusted-firmware;
+      description = "A reference implementation of secure world software for ARMv8-A";
+      license = licenses.bsd3;
+      maintainers = [ maintainers.lopsided98 ];
+      # TODO: Fix when #34444 is merged
+      # platforms = targetPlatforms;
+    } // extraMeta;
+  } // builtins.removeAttrs args [ "extraMeta" ]);
+
+in rec {
+  inherit buildArmTrustedFirmware;
+
+  armTrustedFirmwareRK3328 = buildArmTrustedFirmware rec {
+    extraMakeFlags = [ "bl31" ];
+    platform = "rk3328";
+    targetPlatforms = ["aarch64-linux"];
+    filesToInstall = [ "build/${platform}/release/bl31/bl31.elf"];
+  };
+}
diff --git a/pkgs/misc/uboot/rock64.nix b/pkgs/misc/uboot/rock64.nix
index b6dd99ac6a6d..8c3af2a35a46 100644
--- a/pkgs/misc/uboot/rock64.nix
+++ b/pkgs/misc/uboot/rock64.nix
@@ -1,4 +1,4 @@
-{ buildUBoot, fetchFromGitHub }: buildUBoot rec {
+{ lib, buildUBoot, fetchFromGitHub, armTrustedFirmwareRK3328 }: buildUBoot rec {
   name = "uboot-${defconfig}-${version}";
   version = "2018.01";
 
@@ -9,7 +9,7 @@
     sha256 = "1vmv7q9yafsc0zivd0qdfmf930dvhzkf4a3j6apxxgx9g10wgwrg";
   };
 
-  extraMakeFlags = [ "u-boot.itb" "all" ];
+  extraMakeFlags = [ "BL31=${armTrustedFirmwareRK3328}/bl31.elf" "u-boot.itb" "all" ];
   postBuild = ''
     ./tools/mkimage -n rk3328 -T rksd -d tpl/u-boot-tpl.bin idbloader.img
     cat spl/u-boot-spl.bin >> idbloader.img
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f709ca6e67f5..fe8c1eeae61c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12874,6 +12874,11 @@ with pkgs;
   alsaOss = callPackage ../os-specific/linux/alsa-oss { };
   alsaTools = callPackage ../os-specific/linux/alsa-tools { };
 
+  inherit (callPackage ../misc/arm-trusted-firmware {})
+    buildArmTrustedFirmware
+    armTrustedFirmwareRK3328
+    ;
+
   microcodeAmd = callPackage ../os-specific/linux/microcode/amd.nix { };
 
   microcodeIntel = callPackage ../os-specific/linux/microcode/intel.nix { };