diff --git a/packages/ocismack/Containerfile b/packages/ocismack/Containerfile
new file mode 100644
index 0000000..c5fc6d5
--- /dev/null
+++ b/packages/ocismack/Containerfile
@@ -0,0 +1,40 @@
+FROM scratch AS base
+ENV VERSION=0.1.0
+ENV SRC_HASH=dc9ae7ce78e46351f4f0a8b5ffbb5ff5fdc90bffab9b55cea3c2b3f9ea20123d
+ENV SRC_FILE=ocismack-v${VERSION}.tar.gz
+ENV SRC_SITE=https://codeberg.org/stagex/ocismack/archive/${SRC_FILE}
+
+FROM base AS fetch
+ADD --checksum=sha256:${SRC_HASH} ${SRC_SITE} .
+COPY --from=stagex/rust . /
+COPY --from=stagex/busybox . /
+COPY --from=stagex/musl . /
+COPY --from=stagex/gcc . /
+COPY --from=stagex/llvm . /
+COPY --from=stagex/libunwind . /
+COPY --from=stagex/openssl . /
+COPY --from=stagex/zlib . /
+COPY --from=stagex/ca-certificates . /
+RUN tar xf ${SRC_FILE}
+WORKDIR ocismack
+RUN cargo fetch
+
+FROM fetch AS build
+COPY --from=stagex/binutils . /
+ENV RUSTFLAGS='-C codegen-units=1 -C target-feature=+crt-static'
+RUN --network=none \
+    cargo build \
+        --frozen \
+        --release \
+        --target x86_64-unknown-linux-musl \
+        --bin ocismack
+
+FROM build AS install
+RUN <<-EOF
+    set -eux
+    mkdir -p /rootfs/usr/bin
+    cp target/x86_64-unknown-linux-musl/release/ocismack /rootfs/usr/bin/ocismack
+EOF
+
+FROM stagex/filesystem AS package
+COPY --from=install /rootfs/. /
diff --git a/src/packages.mk b/src/packages.mk
index eb579a1..e154d73 100644
--- a/src/packages.mk
+++ b/src/packages.mk
@@ -1,4 +1,3 @@
-
 .PHONY: abseil-cpp
 abseil-cpp: out/abseil-cpp/index.json
 out/abseil-cpp/index.json: \
@@ -1425,6 +1424,23 @@ out/npth/index.json: \
 	out/zlib/index.json
 	$(call build,npth)
 
+.PHONY: ocismack
+ocismack: out/ocismack/index.json
+out/ocismack/index.json: \
+       packages/ocismack/Containerfile \
+       out/binutils/index.json \
+       out/busybox/index.json \
+       out/ca-certificates/index.json \
+       out/filesystem/index.json \
+       out/gcc/index.json \
+       out/libunwind/index.json \
+       out/llvm/index.json \
+       out/musl/index.json \
+       out/openssl/index.json \
+       out/rust/index.json \
+       out/zlib/index.json
+       $(call build,ocismack)
+
 .PHONY: openpgp-card-tools
 openpgp-card-tools: out/openpgp-card-tools/index.json
 out/openpgp-card-tools/index.json: \