diff --git a/pkgs/python-packages/cryptography/default.nix b/pkgs/python-packages/cryptography/default.nix
new file mode 100644
index 0000000..a852fcd
--- /dev/null
+++ b/pkgs/python-packages/cryptography/default.nix
@@ -0,0 +1,83 @@
+# Copied from nixpkgs rev c7d0dbe094c988209edac801eb2a0cc21aa498d8
+
+{ lib, stdenv
+, buildPythonPackage
+, fetchPypi
+, fetchpatch
+, isPy27
+, ipaddress
+, openssl
+, cryptography_vectors
+, darwin
+, packaging
+, six
+, pythonOlder
+, isPyPy
+, cffi
+, pytest
+, pretend
+, iso8601
+, pytz
+, hypothesis
+, enum34
+}:
+
+buildPythonPackage rec {
+  pname = "cryptography";
+  version = "3.3.2"; # Also update the hash in vectors.nix
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1vcvw4lkw1spiq322pm1256kail8nck6bbgpdxx3pqa905wd6q2s";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = lib.optionals (!isPyPy) [
+    cffi
+  ];
+
+  buildInputs = [ openssl ]
+             ++ lib.optional stdenv.isDarwin darwin.apple_sdk.frameworks.Security;
+  propagatedBuildInputs = [
+    packaging
+    six
+  ] ++ lib.optionals (!isPyPy) [
+    cffi
+  ] ++ lib.optionals isPy27 [
+    ipaddress enum34
+  ];
+
+  checkInputs = [
+    cryptography_vectors
+    hypothesis
+    iso8601
+    pretend
+    pytest
+    pytz
+  ];
+
+  checkPhase = ''
+    py.test --disable-pytest-warnings tests
+  '';
+
+  # IOKit's dependencies are inconsistent between OSX versions, so this is the best we
+  # can do until nix 1.11's release
+  __impureHostDeps = [ "/usr/lib" ];
+
+  meta = with lib; {
+    description = "A package which provides cryptographic recipes and primitives";
+    longDescription = ''
+      Cryptography includes both high level recipes and low level interfaces to
+      common cryptographic algorithms such as symmetric ciphers, message
+      digests, and key derivation functions.
+      Our goal is for it to be your "cryptographic standard library". It
+      supports Python 2.7, Python 3.5+, and PyPy 5.4+.
+    '';
+    homepage = "https://github.com/pyca/cryptography";
+    changelog = "https://cryptography.io/en/latest/changelog/#v"
+      + replaceStrings [ "." ] [ "-" ] version;
+    license = with licenses; [ asl20 bsd3 psfl ];
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/python-packages/cryptography/vectors.nix b/pkgs/python-packages/cryptography/vectors.nix
new file mode 100644
index 0000000..e7f78e5
--- /dev/null
+++ b/pkgs/python-packages/cryptography/vectors.nix
@@ -0,0 +1,25 @@
+# Copied from nixpkgs rev c7d0dbe094c988209edac801eb2a0cc21aa498d8
+
+{ buildPythonPackage, fetchPypi, lib, cryptography }:
+
+buildPythonPackage rec {
+  pname = "cryptography_vectors";
+  # The test vectors must have the same version as the cryptography package:
+  version = cryptography.version;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1yhaps0f3h2yjb6lmz953z1l1d84y9swk4k3gj9nqyk4vbx5m7cc";
+  };
+
+  # No tests included
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Test vectors for the cryptography package";
+    homepage = "https://cryptography.io/en/latest/development/test-vectors/";
+    # Source: https://github.com/pyca/cryptography/tree/master/vectors;
+    license = with licenses; [ asl20 bsd3 ];
+    maintainers = with maintainers; [ primeos ];
+  };
+}
diff --git a/pkgs/python-packages/default.nix b/pkgs/python-packages/default.nix
index 8587bb2..21e875e 100644
--- a/pkgs/python-packages/default.nix
+++ b/pkgs/python-packages/default.nix
@@ -16,8 +16,8 @@ in {
   txzmq = callPackage ./txzmq {};
 
   # cryptography 3.3.2, required by joinmarketdaemon
-  cryptography = callPackage "${unstable}/pkgs/development/python-modules/cryptography" {};
-  cryptography_vectors = callPackage "${unstable}/pkgs/development/python-modules/cryptography/vectors.nix" {};
+  cryptography = callPackage ./cryptography {};
+  cryptography_vectors = callPackage ./cryptography/vectors.nix {};
 
   joinmarketbase = joinmarketPkg ./jmbase;
   joinmarketclient = joinmarketPkg ./jmclient;