diff --git a/1systems/tv/wu.nix b/1systems/tv/wu.nix
index 4a74d552f..5ca64ce9e 100644
--- a/1systems/tv/wu.nix
+++ b/1systems/tv/wu.nix
@@ -28,6 +28,7 @@ in
         gnumake
         parallel
         Zpkgs.genid
+        Zpkgs.hashPassword
         Zpkgs.lentil
 
         # root
diff --git a/Zpkgs/krebs/default.nix b/Zpkgs/krebs/default.nix
index be8f72011..231fda797 100644
--- a/Zpkgs/krebs/default.nix
+++ b/Zpkgs/krebs/default.nix
@@ -6,6 +6,9 @@ in
 
 pkgs //
 {
+  dic = callPackage ./dic.nix {};
+  genid = callPackage ./genid.nix {};
   github-hosts-sync = callPackage ./github-hosts-sync.nix {};
   github-known_hosts = callPackage ./github-known_hosts.nix {};
+  hashPassword = callPackage ./hashPassword.nix {};
 }
diff --git a/Zpkgs/tv/dic.nix b/Zpkgs/krebs/dic.nix
similarity index 100%
rename from Zpkgs/tv/dic.nix
rename to Zpkgs/krebs/dic.nix
diff --git a/Zpkgs/tv/genid.nix b/Zpkgs/krebs/genid.nix
similarity index 100%
rename from Zpkgs/tv/genid.nix
rename to Zpkgs/krebs/genid.nix
diff --git a/Zpkgs/krebs/hashPassword.nix b/Zpkgs/krebs/hashPassword.nix
new file mode 100644
index 000000000..a10340cc4
--- /dev/null
+++ b/Zpkgs/krebs/hashPassword.nix
@@ -0,0 +1,16 @@
+{ lib, pkgs, ... }:
+
+pkgs.writeScriptBin "hashPassword" ''
+  #! /bin/sh
+  # usage: hashPassword
+  set -euf
+
+  export PATH=${lib.makeSearchPath "bin" (with pkgs; [
+    coreutils
+    mkpasswd
+    openssl
+  ])}
+
+  salt=$(openssl rand -base64 16 | tr -d '+=' | head -c 16)
+  exec mkpasswd -m sha-512 -S "$salt"
+''
diff --git a/Zpkgs/tv/default.nix b/Zpkgs/tv/default.nix
index e3e12bd18..50625f868 100644
--- a/Zpkgs/tv/default.nix
+++ b/Zpkgs/tv/default.nix
@@ -2,13 +2,11 @@
 
 let
   inherit (pkgs) callPackage;
+  krebs = import ../../Zpkgs/krebs { inherit pkgs; };
 in
 
-pkgs //
-{
+krebs // {
   charybdis = callPackage ./charybdis {};
-  dic = callPackage ./dic.nix {};
-  genid = callPackage ./genid.nix {};
   lentil = callPackage ./lentil {};
   much = callPackage ./much.nix {};
   viljetic-pages = callPackage ./viljetic-pages {};