diff --git a/flake.nix b/flake.nix
index b792037..cba456c 100644
--- a/flake.nix
+++ b/flake.nix
@@ -113,6 +113,10 @@
             libffi
           ];
         };
+        llvm_cheri = pkgs.mkShell {
+          name = "llvm_cheri";
+          packages = with lowrisc_pkgs; [llvm_cheri];
+        };
       };
       formatter = pkgs.alejandra;
     });
diff --git a/pkgs/default.nix b/pkgs/default.nix
index 221d2cc..5130346 100644
--- a/pkgs/default.nix
+++ b/pkgs/default.nix
@@ -23,6 +23,9 @@
   cheriot-sim = pkgs.callPackage ./cheriot-sim.nix {};
   cheriot-audit = pkgs.callPackage ./cheriot-audit.nix {};
 
+  # Cheri
+  llvm_cheri = pkgs.callPackage ./llvm_cheri.nix {};
+
   verilator_caliptra = pkgs.callPackage ./verilator_caliptra.nix {};
 
   # IT packages
diff --git a/pkgs/llvm_cheri.nix b/pkgs/llvm_cheri.nix
new file mode 100644
index 0000000..83995b9
--- /dev/null
+++ b/pkgs/llvm_cheri.nix
@@ -0,0 +1,41 @@
+# Copyright lowRISC contributors.
+#
+# SPDX-License-Identifier: MIT
+{
+  fetchzip,
+  stdenv,
+  zlib,
+  zstd,
+  ncurses6,
+  autoPatchelfHook,
+}:
+stdenv.mkDerivation rec {
+  name = "cheri-llvm";
+  version = "17.0.1.r01";
+  src = fetchzip {
+    # We build the toolchain in another repository because derivations doesn't allow internet
+    # connection, which is required by cheribuild.
+    url = "https://github.com/engdoreis/cheribuild/releases/download/v${version}/cheri-std093-sdk.tar.gz";
+    hash = "sha256-/6FGm1Ot9sFZ71FIThtLV2KFjhSfnc5w32OucCZmDfc=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+    ncurses6
+    zlib
+    zstd
+  ];
+  nativeBuildInputs = [autoPatchelfHook];
+
+  installPhase = ''
+    mkdir -p $out
+    cp -R ./cheri-std093-sdk/* $out
+  '';
+
+  meta = {
+    platforms = ["x86_64-linux"];
+  };
+}