diff --git a/krebs/5pkgs/bepasty-client-cli/default.nix b/krebs/5pkgs/bepasty-client-cli/default.nix
new file mode 100644
index 000000000..990f99af6
--- /dev/null
+++ b/krebs/5pkgs/bepasty-client-cli/default.nix
@@ -0,0 +1,22 @@
+{ lib, pkgs, pythonPackages, fetchurl, ... }:
+
+with pythonPackages; buildPythonPackage rec {
+  name = "bepasty-client-cli-${version}";
+  version = "0.3.0";
+  propagatedBuildInputs = [
+    python_magic
+    click
+    requests2
+  ];
+
+  src = fetchurl {
+    url = "https://pypi.python.org/packages/source/b/bepasty-client-cli/bepasty-client-cli-${version}.tar.gz";
+    sha256 = "002kcplyfnmr5pn2ywdfilss0rmbm8wcdzz8hzp03ksy2zr4sdbw";
+  };
+
+  meta = {
+    homepage = https://github.com/bepasty/bepasty-client-cli;
+    description = "CLI client for bepasty-server";
+    license = lib.licenses.bsd2;
+  };
+}
diff --git a/krebs/5pkgs/krebspaste/default.nix b/krebs/5pkgs/krebspaste/default.nix
new file mode 100644
index 000000000..13920ad08
--- /dev/null
+++ b/krebs/5pkgs/krebspaste/default.nix
@@ -0,0 +1,9 @@
+{ writeScriptBin, pkgs }:
+
+# TODO: add krebs CA to toolchain, remove --insecure
+# TODO: use `wrapProgram --add-flags` instead?
+
+writeScriptBin "krebspaste" ''
+  #! /bin/sh
+  exec ${pkgs.bepasty-client-cli}/bin/bepasty-cli --insecure --url http://paste.retiolum "$@"
+''