diff --git a/rpms/envoy/metadata.yaml b/rpms/envoy/metadata.yaml
new file mode 100644
index 0000000..e04ae07
--- /dev/null
+++ b/rpms/envoy/metadata.yaml
@@ -0,0 +1,15 @@
+name: envoy
+github: envoyproxy/envoy
+description: Cloud-native high-performance edge/middle/service proxy.
+arch: amd64
+platform: linux
+maintainer: Envoy Project Authors
+homepage: https://github.com/envoyproxy/envoy
+license: Apache-2.0
+dist_tag: true
+builds:
+- repository:
+  - almalinux/el9
+  image: git.unkin.net/unkin/almalinux9-rpmbuilder:latest
+  release: 1
+  version: 1.35.13
diff --git a/rpms/envoy/resources/build.sh b/rpms/envoy/resources/build.sh
new file mode 100755
index 0000000..b62008e
--- /dev/null
+++ b/rpms/envoy/resources/build.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/bash
+
+set -e
+
+ASSET="envoy-${PACKAGE_VERSION}-linux-x86_64"
+BASE_URL="https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/github/envoyproxy/envoy/releases/download/v${PACKAGE_VERSION}"
+
+curl -fL -o /app/envoy "${BASE_URL}/${ASSET}"
+curl -fL -o /app/checksums.txt.asc "${BASE_URL}/checksums.txt.asc"
+
+# Upstream lists the asset under a temp build path; check it against the local filename.
+cd /app
+awk -v a="/${ASSET}" '$2 ~ a"$" {print $1"  envoy"}' checksums.txt.asc | grep . | sha256sum --check --strict -
+chmod +x /app/envoy
+
+envsubst < /app/resources/nfpm.yaml > /app/nfpm.yaml
+
+nfpm pkg --config /app/nfpm.yaml --target /app/dist --packager rpm
diff --git a/rpms/envoy/resources/nfpm.yaml b/rpms/envoy/resources/nfpm.yaml
new file mode 100644
index 0000000..38ae3ee
--- /dev/null
+++ b/rpms/envoy/resources/nfpm.yaml
@@ -0,0 +1,38 @@
+# nfpm.yaml
+
+name: ${PACKAGE_NAME}
+version: ${PACKAGE_VERSION}
+release: ${PACKAGE_RELEASE}
+arch: ${PACKAGE_ARCH}
+platform: ${PACKAGE_PLATFORM}
+section: default
+priority: extra
+description: "${PACKAGE_DESCRIPTION}"
+
+maintainer: ${PACKAGE_MAINTAINER}
+homepage: ${PACKAGE_HOMEPAGE}
+license: ${PACKAGE_LICENSE}
+
+disable_globbing: false
+
+replaces:
+  - envoy
+
+provides:
+  - envoy
+
+# Files to include in the package
+contents:
+  - src: /app/envoy
+    dst: /usr/bin/envoy
+    file_info:
+      mode: 0755
+      owner: root
+      group: root
+
+# Scripts to run during installation/removal (optional)
+# scripts:
+#   preinstall: ./scripts/preinstall.sh
+#   postinstall: ./scripts/postinstall.sh
+#   preremove: ./scripts/preremove.sh
+#   postremove: ./scripts/postremove.sh