diff --git a/nixos/modules/services/networking/frr.nix b/nixos/modules/services/networking/frr.nix
index 45a82b9450a4..98452123f030 100644
--- a/nixos/modules/services/networking/frr.nix
+++ b/nixos/modules/services/networking/frr.nix
@@ -106,6 +106,14 @@ let
           TCP Port to bind to for the VTY interface.
         '';
       };
+
+      extraOptions = mkOption {
+        type = types.listOf types.str;
+        default = [];
+        description = ''
+          Extra options for the daemon.
+        '';
+      };
     };
 
 in
@@ -196,7 +204,8 @@ in
                 PIDFile = "frr/${daemon}.pid";
                 ExecStart = "${pkgs.frr}/libexec/frr/${daemon} -f /etc/frr/${service}.conf"
                   + optionalString (scfg.vtyListenAddress != "") " -A ${scfg.vtyListenAddress}"
-                  + optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}";
+                  + optionalString (scfg.vtyListenPort != null) " -P ${toString scfg.vtyListenPort}"
+                  + " " + (concatStringsSep " " scfg.extraOptions);
                 ExecReload = "${pkgs.python3.interpreter} ${pkgs.frr}/libexec/frr/frr-reload.py --reload --daemon ${daemonName service} --bindir ${pkgs.frr}/bin --rundir /run/frr /etc/frr/${service}.conf";
                 Restart = "on-abnormal";
               };
diff --git a/pkgs/development/libraries/rtrlib/default.nix b/pkgs/development/libraries/rtrlib/default.nix
new file mode 100644
index 000000000000..bb0aec308ae8
--- /dev/null
+++ b/pkgs/development/libraries/rtrlib/default.nix
@@ -0,0 +1,24 @@
+{ lib, fetchFromGitHub, stdenv, cmake, libssh, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "rtrlib";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    repo = pname;
+    owner = "rtrlib";
+    rev = "v${version}";
+    sha256 = "sha256-ISb4ojcDvXY/88GbFMrA5V5+SGE6CmE5D+pokDTwotQ=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [ libssh openssl ];
+
+  meta = with lib; {
+    description = "An open-source C implementation of the RPKI/Router Protocol client";
+    homepage = "https://github.com/rtrlib/rtrlib";
+    license = licenses.mit;
+    maintainers = with maintainers; [ Anillc ];
+    platforms = platforms.all;
+  };
+}
diff --git a/pkgs/servers/frr/default.nix b/pkgs/servers/frr/default.nix
index 302c5a472bd0..5e5cd767002d 100644
--- a/pkgs/servers/frr/default.nix
+++ b/pkgs/servers/frr/default.nix
@@ -23,6 +23,7 @@
 , pcre2
 , python3
 , readline
+, rtrlib
 
 # tests
 , nettools
@@ -62,6 +63,7 @@ stdenv.mkDerivation rec {
     pcre2
     python3
     readline
+    rtrlib
   ] ++ lib.optionals stdenv.isLinux [
     libcap
   ];
@@ -78,6 +80,7 @@ stdenv.mkDerivation rec {
     "--localstatedir=/run/frr"
     "--sbindir=$(out)/libexec/frr"
     "--sysconfdir=/etc/frr"
+    "--enable-rpki"
   ];
 
   postPatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2ed6a5e2c3e7..6b5b6e67c84a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -20292,6 +20292,8 @@ with pkgs;
 
   rinutils = callPackage ../development/libraries/rinutils { };
 
+  rtrlib = callPackage ../development/libraries/rtrlib { };
+
   kissfft = callPackage ../development/libraries/kissfft { };
 
   lambdabot = callPackage ../development/tools/haskell/lambdabot {