diff --git a/flake.nix b/flake.nix
index 63526c3a..1b07401e 100644
--- a/flake.nix
+++ b/flake.nix
@@ -115,14 +115,7 @@
       knot-cross = final.pkgsCross.gnu64.pkgsStatic.buildGoModule (knotBuildAttrs final); # cross-compile on darwin to x86_64-linux
       knot-unwrapped = final.pkgsStatic.buildGoModule (knotBuildAttrs final);
 
-      genjwks = final.buildGoModule {
-        pname = "genjwks";
-        version = "0.1.0";
-        src = gitignoreSource ./.;
-        subPackages = ["cmd/genjwks"];
-        vendorHash = goModHash;
-        env.CGO_ENABLED = 0;
-      };
+      genjwks = final.callPackage ./nix/pkgs/genjwks.nix {inherit goModHash gitignoreSource;};
     };
     packages = forAllSystems (system: {
       inherit
diff --git a/nix/pkgs/genjwks.nix b/nix/pkgs/genjwks.nix
new file mode 100644
index 00000000..6af8d4a9
--- /dev/null
+++ b/nix/pkgs/genjwks.nix
@@ -0,0 +1,13 @@
+{
+  buildGoModule,
+  goModHash,
+  gitignoreSource,
+}:
+buildGoModule {
+  pname = "genjwks";
+  version = "0.1.0";
+  src = gitignoreSource ../..;
+  subPackages = ["cmd/genjwks"];
+  vendorHash = goModHash;
+  env.CGO_ENABLED = 0;
+}