diff --git a/nix/default.nix b/nix/default.nix
index 9605b5b0c6e1a7ab470edbce26fa13aee556cd2b..349c8369f6a81b1934ad076982d3ef92dbc39a4d 100644
--- a/nix/default.nix
+++ b/nix/default.nix
@@ -1,4 +1,4 @@
-{ pkgs ? import <nixpkgs> {} }:
+{ pkgs ? import <nixpkgs> { overlays = [ (import ./overlay.nix) ]; } }:
 
 let
   # Pin a particular version of haskell.nix.  The particular version isn't
diff --git a/nix/overlay.nix b/nix/overlay.nix
new file mode 100644
index 0000000000000000000000000000000000000000..2673b39a9a30912c088deed29eeaa6a698e0f232
--- /dev/null
+++ b/nix/overlay.nix
@@ -0,0 +1,3 @@
+self: super: {
+  ristretto = super.callPackage ./ristretto.nix { };
+}
diff --git a/nix/privacypass-repo.nix b/nix/privacypass-repo.nix
new file mode 100644
index 0000000000000000000000000000000000000000..6b0c64cff07889c23400e15e1d2824d3ac8905cf
--- /dev/null
+++ b/nix/privacypass-repo.nix
@@ -0,0 +1,7 @@
+{ fetchFromGitHub }:
+fetchFromGitHub {
+  owner = "LeastAuthority";
+  repo = "privacypass";
+  rev = "45855401e163f8e622bd93a5c5bce13de8c8510a";
+  sha256 = "sha256:15wv8vas6x8cdicylp0m632c916p7qxq1k4lnchr8c92lldp0rv7";
+}
diff --git a/nix/ristretto.nix b/nix/ristretto.nix
new file mode 100644
index 0000000000000000000000000000000000000000..4e0912840d99a23263408dd86be620e23c92d7e3
--- /dev/null
+++ b/nix/ristretto.nix
@@ -0,0 +1,5 @@
+{ fetchFromGitHub, callPackage }:
+let
+  src = import ./privacypass-repo.nix { inherit fetchFromGitHub; };
+in
+  callPackage "${src}/ristretto.nix" { }