diff --git a/nix/arcanist.nix b/nix/arcanist.nix
new file mode 100644
index 000000000..03f8caef8
--- /dev/null
+++ b/nix/arcanist.nix
@@ -0,0 +1,64 @@
+{ stdenv
+, lib
+, cacert
+, fetchFromGitHub
+, installShellFiles
+, makeWrapper
+, php80
+, python3
+, which
+}:
+
+stdenv.mkDerivation {
+  pname = "arcanist";
+  version = "20220517";
+
+  src = fetchFromGitHub {
+    owner = "phacility";
+    repo = "arcanist";
+    rev = "85c953ebe4a6fef332158fd757d97c5a58682d3a";
+    sha256 = "0x847fw74mzrbhzpgc4iqgvs6dsf4svwfa707dsbxi78fn2lxbl7";
+  };
+
+  # These need to be in PATH during the build
+  nativeBuildInputs = [ php80 python3 installShellFiles makeWrapper ];
+
+  # Since we are exporting a script, we do not need to do an actual "build"
+  doBuild = false;
+
+  installPhase = ''
+    # Copy arcanist contents
+    mkdir -p $out/libexec
+    cp -R . $out/libexec/arcanist
+
+    # provide a recent up-to-date certificate bundle for ssl
+    ln -sf ${cacert}/etc/ssl/certs/ca-bundle.crt \
+      $out/libexec/arcanist/resources/ssl/default.pem
+
+    # convert `#!/usr/bin/env php` into calling nixpkgs php interpreter
+    patchShebangs $out/libexec/arcanist/bin/arc
+
+    # Create a bin/arc which points to the real script, but provides
+    # assumptions such as the PATH including python3 and which
+    makeWrapper $out/libexec/arcanist/bin/arc $out/bin/arc \
+      --prefix PATH : ${lib.makeBinPath [ which python3 ]}
+
+    # Add shell completion for bash
+    $out/bin/arc shell-complete --generate --
+    installShellCompletion --cmd arc --bash \
+      $out/libexec/arcanist/support/shell/rules/bash-rules.sh
+  '';
+
+  # Ensure `arc` is able to run without failing
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/arc help diff -- > /dev/null
+  '';
+
+  meta = {
+    description = "Command line interface to Phabricator";
+    homepage = "http://phabricator.org";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/nix/overlay.nix b/nix/overlay.nix
index 6d81ec474..80ac0e7bf 100644
--- a/nix/overlay.nix
+++ b/nix/overlay.nix
@@ -1,93 +1,95 @@
 # An overlay allows for a package set to be extended with new or modified packages
 
 # `final` refers to the package set with all overlays applied.
 # This allows for added or modified packages to be referenced with
 # all relevant changes
 final:
 
 # `prev` refers to the previous package set before this current overlay is applied.
 # This is cheaper for nix to evaluate, thus should be prefered over final when possible.
 prev:
 
 {
   # Patch aws-sdk-cpp to automatically pick up header location
   # specific to nixpkgs, as nixpkgs separates build-time and runtime
   # depencenies (a saving of 400MB in header + generated files).
   # In the case of c and c++, this means the header files are
   # located in a separate directory from the libraries.
   #
   # From a developer perspective, this avoids having to manually specify
   # the header location with `-DAWS_CORE_HEADER_FILE` each time
   # one invokes `cmake` on the command line when using
   # `find_package(AWSSDK COMPONENTS [comps])`
   #
   # For more information, see:
   # - aws-sdk-cpp issue: https://github.com/aws/aws-sdk-cpp/issues/2009
   # - Nixpkgs fix: https://github.com/NixOS/nixpkgs/pull/182918
   aws-sdk-cpp = (prev.aws-sdk-cpp.overrideAttrs(oldAttrs:{
     postPatch = oldAttrs.postPatch + ''
       substituteInPlace cmake/AWSSDKConfig.cmake \
         --replace 'C:/AWSSDK/''${AWSSDK_INSTALL_INCLUDEDIR}/aws/core' \
           'C:/AWSSDK/''${AWSSDK_INSTALL_INCLUDEDIR}/aws/core"
           "${placeholder "dev"}/include/aws/core'
     '';
   })).override {
     # avoid rebuildilng all 300+ apis
     apis = [ "core" "s3" "dynamodb" ];
   };
 
   # add packages meant for just this repository
   amqp-cpp = prev.callPackage ./amqp-cpp.nix { };
 
+  arcanist = prev.callPackage ./arcanist.nix { };
+
   protobuf_3_15_cmake = prev.callPackage ./protobuf_3_15.nix { };
 
   devShell = final.callPackage ./dev-shell.nix { };
 
   mysql-down = prev.callPackage ./mysql-down-linux.nix { };
 
   mysql-up = prev.callPackage ./mysql-up-linux.nix { };
 
   olm = prev.olm.overrideAttrs(oldAttrs: {
     # *.hh files aren't meant to be used externally
     # so we patch installation to add it
     postInstall = ''
       cp \
         $NIX_BUILD_TOP/${oldAttrs.src.name}/include/olm/*.h* \
         ''${!outputDev}/include/olm
     '';
   });
 
   # 16.14 now requires experimental import assertions syntax, pin to 16.13
   # https://github.com/nodejs/node/blob/main/doc/changelogs/CHANGELOG_V16.md
   nodejs-16_x = prev.nodejs-16_x.overrideAttrs (oldAttrs: rec {
     version = "16.13.0";
     name = "nodejs-${version}";
 
     src = prev.fetchurl {
       url = "https://nodejs.org/dist/v${version}/node-v${version}.tar.xz";
       sha256 = "sha256-MhFLPcOUXtD5X4vDO0LGjg7xjECMtWEiVyoWPZB+y8w=";
     };
 
     # Nixpkgs applies two patches for 16.15. One patch is for finding headers
     # needed for v8 on darwin using apple_sdk 11; the other patch fixes crashes
     # related cache dir defaulting to using `$HOME` without asserting that
     # it exists.
     #
     # However, 16.13 doesn't need the second patch, as the regression which
     # caused it was introduced after 16.13. This ends up being a no-op. But
     # nix will still try to apply the patch and fail with "this patch has
     # already been applied".
     #
     # For more context, see (https://github.com/npm/cli/pull/5197)
     #
     # lib.head will select the first element in an array
     patches = [
       (prev.lib.head oldAttrs.patches)
     ];
   });
 
   # Ensure that yarn is using the pinned version
   yarn = prev.yarn.override (_: {
     nodejs = final.nodejs-16_x;
   });
 }