diff --git a/README.md b/README.md
index d102ee1..fa2c452 100644
--- a/README.md
+++ b/README.md
@@ -66,8 +66,9 @@ NixOS modules ([src](modules/modules.nix))
   * [clightning](https://github.com/ElementsProject/lightning) with support for announcing an onion service\
     Available plugins:
     * [clboss](https://github.com/ZmnSCPxj/clboss): automated C-Lightning Node Manager
+    * [commando](https://github.com/lightningd/plugins/tree/master/commando): control your node over lightning
     * [helpme](https://github.com/lightningd/plugins/tree/master/helpme): walks you through setting up a fresh c-lightning node
-    * [monitor](https://github.com/renepickhardt/plugins/tree/master/monitor): helps you analyze the health of your peers and channels
+    * [monitor](https://github.com/lightningd/plugins/tree/master/monitor): helps you analyze the health of your peers and channels
     * [prometheus](https://github.com/lightningd/plugins/tree/master/prometheus): lightning node exporter for the prometheus timeseries server
     * [rebalance](https://github.com/lightningd/plugins/tree/master/rebalance): keeps your channels balanced
     * [summary](https://github.com/lightningd/plugins/tree/master/summary): print a nice summary of the node status
diff --git a/modules/clightning-plugins/commando.nix b/modules/clightning-plugins/commando.nix
new file mode 100644
index 0000000..b9c19f4
--- /dev/null
+++ b/modules/clightning-plugins/commando.nix
@@ -0,0 +1,37 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let cfg = config.services.clightning.plugins.commando; in
+{
+  options.services.clightning.plugins.commando = {
+    enable = mkEnableOption "commando (clightning plugin)";
+    readers = mkOption {
+      type = with types; listOf str;
+      default = [];
+      example = [ "0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518" ];
+      description = ''
+        IDs of nodes which can execute read-only commands (list*, get*, ...).
+      '';
+    };
+    writers = mkOption {
+      type = with types; listOf str;
+      default = [];
+      example = [ "0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518" ];
+      description = ''
+        IDs of nodes which can execute any commands.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.clightning.extraConfig = ''
+      plugin=${config.nix-bitcoin.pkgs.clightning-plugins.commando.path}
+    ''
+    + concatMapStrings (reader: ''
+      commando_reader=${reader}
+    '') cfg.readers
+    + concatMapStrings (writer: ''
+      commando_writer=${writer}
+    '') cfg.writers;
+  };
+}
diff --git a/modules/clightning-plugins/default.nix b/modules/clightning-plugins/default.nix
index 9a39782..da30464 100644
--- a/modules/clightning-plugins/default.nix
+++ b/modules/clightning-plugins/default.nix
@@ -13,6 +13,7 @@ let
 in {
   imports = [
     ./clboss.nix
+    ./commando.nix
     ./prometheus.nix
     ./summary.nix
     ./zmq.nix
diff --git a/pkgs/clightning-plugins/default.nix b/pkgs/clightning-plugins/default.nix
index 45498aa..eb1d5ac 100644
--- a/pkgs/clightning-plugins/default.nix
+++ b/pkgs/clightning-plugins/default.nix
@@ -6,8 +6,8 @@ let
   src = pkgs.fetchFromGitHub {
     owner = "lightningd";
     repo = "plugins";
-    rev = "1f6f701bf1e60882b8fa61cb735e7033c8c29e3c";
-    sha256 = "088h0yxs0fbrr7r6mi4xmznf0a294i45fbc792xrmwchlay0k7jj";
+    rev = "b88c9278102ea9bffddce8143d31e939b31e835c";
+    sha256 = "sha256-qf4MYqP2Bwlqqn2y2LCIYuFq71r2m6IFT/w4noW6ePU=";
   };
 
   version = builtins.substring 0 7 src.rev;
@@ -23,6 +23,10 @@ let
         + " --replace pyln-client~=0.9.3 pyln-client~=0.10.1";
     };
     rebalance = { description = "Keeps your channels balanced"; };
+    commando = {
+      description = "Enable RPC over lightning";
+      extraPkgs = [ nbPython3Packages.runes ];
+    };
     summary = {
       description = "Prints a summary of the node status";
       extraPkgs = [ packaging requests ];
diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix
index 0c0f9d3..c7162f3 100644
--- a/pkgs/python-packages/default.nix
+++ b/pkgs/python-packages/default.nix
@@ -11,6 +11,8 @@ in {
   urldecode = callPackage ./urldecode {};
   chromalog = callPackage ./chromalog {};
   txzmq = callPackage ./txzmq {};
+  sha256 = callPackage ./sha256 {};
+  runes = callPackage ./runes {};
 
   joinmarketbase = joinmarketPkg ./jmbase;
   joinmarketclient = joinmarketPkg ./jmclient;
diff --git a/pkgs/python-packages/pyln-proto/default.nix b/pkgs/python-packages/pyln-proto/default.nix
index c7b269a..80303a2 100644
--- a/pkgs/python-packages/pyln-proto/default.nix
+++ b/pkgs/python-packages/pyln-proto/default.nix
@@ -4,6 +4,7 @@
 , coincurve
 , base58
 , mypy
+, pycparser
 , setuptools-scm
 }:
 
@@ -17,6 +18,7 @@ buildPythonPackage rec {
     bitstring
     cryptography
     coincurve
+    pycparser
     base58
     mypy
     setuptools-scm
@@ -27,6 +29,7 @@ buildPythonPackage rec {
   postUnpack = "sourceRoot=$sourceRoot/contrib/pyln-proto";
   postPatch = ''
     sed -i '
+      s|pycparser==2.20|pycparser~=2.20|
       s|coincurve ~= 13.0|coincurve == 15.0.0|
       s|base58 ~= 2.0.1|base58 == 2.1.0|
       s|mypy==0.790|mypy == 0.812|
diff --git a/pkgs/python-packages/runes/default.nix b/pkgs/python-packages/runes/default.nix
new file mode 100644
index 0000000..125c0bb
--- /dev/null
+++ b/pkgs/python-packages/runes/default.nix
@@ -0,0 +1,22 @@
+{ sha256, lib, buildPythonPackage, fetchFromGitHub }:
+
+buildPythonPackage {
+  pname = "runes";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    repo = "runes";
+    owner = "rustyrussell";
+    rev = "7e3d7648db844ce2c78cc3e9e4f872f827252251";
+    sha256 = "sha256-e0iGLV/57gCpqA7vrW6JMFM0R6iAq5oFwUpZoGySwfs=";
+  };
+
+  propagatedBuildInputs = [ sha256 ];
+
+  meta = with lib; {
+    description = "Runes for authentication (like macaroons only simpler)";
+    homepage = "https://github.com/rustyrussell/runes";
+    maintainers = with maintainers; [ jb55 ];
+    license = licenses.mit;
+  };
+}
diff --git a/pkgs/python-packages/sha256/default.nix b/pkgs/python-packages/sha256/default.nix
new file mode 100644
index 0000000..50fd0c7
--- /dev/null
+++ b/pkgs/python-packages/sha256/default.nix
@@ -0,0 +1,32 @@
+{ lib, buildPythonPackage, fetchFromGitHub, cython }:
+
+buildPythonPackage rec {
+  pname = "sha256";
+  version = builtins.substring 0 8 src.rev;
+
+  # The version from pypi is old/broken
+  src = fetchFromGitHub {
+    repo = "sha256";
+    owner = "cloudtools";
+    rev = "e0645d118f7296dde45397a755261f78d421bdee";
+    sha256 = "sha256-gEctMgF5qZiWelVHVCl3zazRNuaQ7lJP8ExI5xWEBVI=";
+  };
+
+  nativeBuildInputs = [ cython ];
+
+  doCheck = false;
+
+  configurePhase = ''
+    python setup.py sdist
+  '';
+
+  meta = with lib; {
+    description = ''
+      SHA-256 implementation that allows for setting and getting the mid-state
+      information.
+    '';
+    homepage = "https://github.com/cloudtools/sha256";
+    maintainers = with maintainers; [ jb55 ];
+    license = licenses.mit;
+  };
+}
diff --git a/test/tests.nix b/test/tests.nix
index 7f06a16..b746295 100644
--- a/test/tests.nix
+++ b/test/tests.nix
@@ -132,6 +132,11 @@ let
         prometheus.enable = true;
         rebalance.enable = true;
         summary.enable = true;
+        commando = {
+          enable = true;
+          readers = [ "0266e4598d1d3c415f572a8488830b60f7e744ed9235eb0b1ba93283b315c03518" ];
+          writers = [ "0336efaa22b8ba77ae721a25d589e1c5f2486073dd2f041add32a23316150e8b62" ];
+        };
         zmq = let tcpEndpoint = "tcp://127.0.0.1:5501"; in {
           enable = true;
           channel-opened = tcpEndpoint;