diff --git a/jwt-tool.yaml b/jwt-tool.yaml
new file mode 100644
index 00000000000..8fe357a9347
--- /dev/null
+++ b/jwt-tool.yaml
@@ -0,0 +1,50 @@
+package:
+  name: jwt-tool
+  version: 2.2.6
+  epoch: 0
+  description: "toolkit for validating, forging, scanning and tampering JWTs"
+  copyright:
+    - license: GPL-3.0
+  dependencies:
+    runtime:
+      - python3
+
+environment:
+  contents:
+    packages:
+      - python3
+      - py3-pip
+      - busybox
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/ticarpi/jwt_tool
+      tag: v${{package.version}}
+      expected-commit: 0950b91d34281246129a82b9a3153e41cd0aed40
+      destination: jwt-tool
+
+  - runs: |
+      mkdir -p "${{targets.destdir}}"/usr/share/app/jwt-tool && mkdir -p "${{targets.destdir}}"/usr/bin
+      mv jwt-tool/* "${{targets.destdir}}"/usr/share/app/jwt-tool
+      cd "${{targets.destdir}}"/usr/share/app/jwt-tool
+
+      python -m venv .venv
+      .venv/bin/pip install --no-cache-dir -r requirements.txt
+
+      JWT_TOOL_PYTHON_PATH="#!/usr/share/app/jwt-tool/.venv/bin/python"
+      sed -i "1s,.*,$JWT_TOOL_PYTHON_PATH," jwt_tool.py
+
+      rm -r Dockerfile LICENSE README.md
+
+      chmod +x jwt_tool.py
+
+      ln -s /usr/share/app/jwt-tool/jwt_tool.py "${{targets.destdir}}"/usr/bin/jwt-tool
+
+  - uses: strip
+
+update:
+  enabled: true
+  github:
+    strip-prefix: v
+    identifier: ticarpi/jwt_tool
diff --git a/packages.txt b/packages.txt
index 1370d5df9fb..01fe50997c9 100644
--- a/packages.txt
+++ b/packages.txt
@@ -854,3 +854,4 @@ wit-bindgen
 wasm-tools
 corepack
 esbuild
+jwt-tool