diff --git a/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix b/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
new file mode 100644
index 000000000000..be58c8b5f4cd
--- /dev/null
+++ b/pkgs/development/python-modules/sigstore-protobuf-specs/default.nix
@@ -0,0 +1,43 @@
+{ lib
+, pythonOlder
+, flit-core
+, fetchPypi
+, buildPythonPackage
+, betterproto
+}:
+
+buildPythonPackage rec {
+  pname = "sigstore-protobuf-specs";
+  version = "0.2.2";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    pname = "sigstore_protobuf_specs";
+    inherit version;
+    hash = "sha256-wFwedHioCvDH3qnMLRHwR4JuTAKVc9VkE394jhE3c5E=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    betterproto
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "sigstore_protobuf_specs"
+  ];
+
+  meta = with lib; {
+    description = "Library for serializing and deserializing Sigstore messages";
+    homepage = "https://pypi.org/project/sigstore-protobuf-specs/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1ce8bbf9c54f..4c6a2cf178e0 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12911,6 +12911,8 @@ self: super: with self; {
 
   sigrok = callPackage ../development/python-modules/sigrok { };
 
+  sigstore-protobuf-specs = callPackage ../development/python-modules/sigstore-protobuf-specs { };
+
   sigstore-rekor-types = callPackage ../development/python-modules/sigstore-rekor-types { };
 
   sigtools = callPackage ../development/python-modules/sigtools { };