diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c3f5c48..9efb2a2 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -21,12 +21,6 @@ jobs:
             substituters = https://42loco42.cachix.org https://cache.nixos.org
             trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= 42loco42.cachix.org-1:6HvWFER3RdTSqEZDznqahkqaoI6QCOiX2gRpMMsThiQ=
 
-      # - name: Enable Cachix
-      #   uses: cachix/cachix-action@v14
-      #   with:
-      #     name: 42loco42
-      #     authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
-
       - name: Run CI
         run: nix run .#ci
         env:
diff --git a/README.md b/README.md
index 3426c7c..987a40c 100644
--- a/README.md
+++ b/README.md
@@ -34,5 +34,6 @@ A personal collection of unusual things
 |`prettier-plugin-go-template`|Fixes prettier formatting for go templates|https://github.com/NiklasPor/prettier-plugin-go-template|
 |`pug`|Pug 3 CLI interface|https://github.com/tokilabs/pug3-cli|
 |`redis-json`|RedisJSON - a JSON data type for Redis|https://github.com/RedisJSON/RedisJSON|
+|`sae_pk_gen`|SAE-PK key generator|https://github.com/vanhoefm/hostap-wpa3|
 |`samloader`|Download Samsung firmware from official servers|https://github.com/samloader/samloader|
 |`wayland-shell`|Small-scale replacement of the GNOME Shell|https://github.com/nilsherzig/wayland-shell|
diff --git a/flake.nix b/flake.nix
index 443e43c..656c9aa 100644
--- a/flake.nix
+++ b/flake.nix
@@ -11,6 +11,8 @@
 
   outputs = { self, nixpkgs, nce, nsc }:
     let
+      inherit (nixpkgs.lib) mapAttrsToList pipe recursiveUpdate;
+
       mkLanza030 = pkgs: import (pkgs.fetchFromGitHub {
         owner = "nix-community";
         repo = "lanzaboote";
@@ -50,6 +52,7 @@
           prettier-plugin-go-template = pkgs.callPackage ./packages/prettier-plugin-go-template.nix { };
           pug = pkgs.callPackage ./packages/pug { };
           redis-json = pkgs.callPackage ./packages/redis-json { };
+          sae_pk_gen = pkgs.callPackage ./packages/sae_pk_gen.nix { };
           samloader = pkgs.callPackage ./packages/samloader.nix { };
           wayland-shell = pkgs.callPackage ./packages/wayland-shell.nix { inherit gtk4-layer-shell; };
 
@@ -93,7 +96,7 @@
       mkPackageSet = system: { packages.${system} = mkPackages system; };
 
       pkgs = import nixpkgs { system = "x86_64-linux"; };
-      merge = builtins.foldl' nixpkgs.lib.recursiveUpdate { };
+      merge = builtins.foldl' recursiveUpdate { };
     in
     merge [
       (mkPackageSet "x86_64-linux")
@@ -122,7 +125,7 @@
           inherit ((mkLanza030 pkgs).nixosModules) lanzaboote;
         };
 
-        templates = let dir = ./templates; in nixpkgs.lib.pipe dir [
+        templates = let dir = ./templates; in pipe dir [
           builtins.readDir
           builtins.attrNames
           (map (name: {
@@ -135,8 +138,8 @@
           builtins.listToAttrs
         ];
 
-        readme = nixpkgs.lib.pipe self.packages.${pkgs.system} [
-          (nixpkgs.lib.mapAttrsToList (name: p:
+        readme = pipe self.packages.${pkgs.system} [
+          (mapAttrsToList (name: p:
             "|`${name}`|${p.meta.description or ""}|${p.meta.homepage or ""}|"))
           (builtins.concatStringsSep "\n")
           (s: pkgs.writeText "readme"
@@ -164,6 +167,8 @@
             | cachix push 42loco42
           '';
         };
+
+        foo = nixpkgs.lib.getExe self.packages.${pkgs.system}.sae_pk_gen;
       }
     ];
 }
diff --git a/packages/sae_pk_gen.nix b/packages/sae_pk_gen.nix
new file mode 100644
index 0000000..f717d5d
--- /dev/null
+++ b/packages/sae_pk_gen.nix
@@ -0,0 +1,31 @@
+{ fetchFromGitHub, stdenv, pkg-config, openssl }:
+stdenv.mkDerivation rec {
+  pname = "sae_pk_gen";
+  version = "72e2975";
+
+  src = fetchFromGitHub {
+    owner = "vanhoefm";
+    repo = "hostap-wpa3";
+    rev = version;
+    hash = "sha256-zveLNcZN7+L1iw3i9tq8fOgCh7VdMTg8B2PEoJ2fGwQ=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  buildPhase = ''
+    cd hostapd
+    cp defconfig .config
+    make -j $(nproc) ${pname}
+  '';
+
+  installPhase = ''
+    install -Dm755 ${pname} $out/bin/${pname}
+  '';
+
+  meta = {
+    mainProgram = pname;
+    description = "SAE-PK key generator";
+    homepage = "https://github.com/vanhoefm/hostap-wpa3";
+  };
+}