diff --git a/srcpkgs/bitmask-vpn/files/org.void.pkexec.bitmask-root.policy b/srcpkgs/bitmask-vpn/files/org.void.pkexec.bitmask-root.policy
new file mode 100644
index 00000000000000..27fcd499d18e88
--- /dev/null
+++ b/srcpkgs/bitmask-vpn/files/org.void.pkexec.bitmask-root.policy
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE policyconfig PUBLIC
+ "-//freedesktop//DTD PolicyKit Policy Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/PolicyKit/1/policyconfig.dtd">
+<policyconfig>
+  <action id="org.void.pkexec.bitmask-root">
+    <message>Authentication is required to configure the VPN</message>
+    <icon_name>riseup-vpn</icon_name>
+    <defaults>
+      <allow_any>auth_admin</allow_any>
+      <allow_inactive>auth_admin</allow_inactive>
+      <allow_active>auth_admin</allow_active>
+    </defaults>
+    <annotate key="org.freedesktop.policykit.exec.path">/usr/bin/bitmask-root</annotate>
+    <annotate key="org.freedesktop.policykit.exec.allow_gui">true</annotate>
+  </action>
+</policyconfig>
diff --git a/srcpkgs/bitmask-vpn/files/riseup-vpn.desktop b/srcpkgs/bitmask-vpn/files/riseup-vpn.desktop
new file mode 100755
index 00000000000000..14ca1501f62d2d
--- /dev/null
+++ b/srcpkgs/bitmask-vpn/files/riseup-vpn.desktop
@@ -0,0 +1,8 @@
+[Desktop Entry]
+Type=Application
+Name=RiseupVPN
+Comment=Encrypted VPN
+Exec=riseup-vpn
+Icon=riseup-vpn
+Terminal=false
+Categories=Network;
diff --git a/srcpkgs/bitmask-vpn/template b/srcpkgs/bitmask-vpn/template
new file mode 100644
index 00000000000000..d45ccdecfb05dd
--- /dev/null
+++ b/srcpkgs/bitmask-vpn/template
@@ -0,0 +1,49 @@
+# Template file for 'bitmask-vpn'
+pkgname=bitmask-vpn
+version=0.25.8
+revision=1
+build_style=qmake
+hostmakedepends="go qt6-base-devel qt6-declarative-devel qt6-svg-devel qt6-tools python3"
+makedepends="qt6-base-devel qt6-declarative-devel qt6-svg-devel"
+depends="openvpn polkit elogind iptables"
+short_desc="RiseupVPN client, encrypted VPN based on the LEAP platform"
+maintainer="Mason Girgis <wavyjo3@tutamail.com>"
+license="GPL-3.0-or-later"
+homepage="https://0xacab.org/leap/bitmask-vpn"
+distfiles="https://0xacab.org/leap/bitmask-vpn/-/archive/${version}/bitmask-vpn-${version}.tar.gz"
+checksum=c05dad484280fa827b2023fdc0e6c5ba5e4e6984d46a8bd4970c4c658fecff65
+# Tests require network access to live riseup.net infrastructure
+make_check=no
+
+pre_configure() {
+	cd ${wrksrc}
+	ln -sf riseup/assets providers/assets
+	cd providers/riseup/assets
+	ln -sf icon.svg riseup.svg
+	cd ../../..
+	CGO_ENABLED=1 go build -buildmode=c-archive -o lib/libgoshim.a gui/backend.go
+	PROVIDER=riseup VENDOR_PATH=providers python3 branding/scripts/gen-providers-json gui/providers/providers.json
+	mkdir -p build/qt
+}
+do_configure() {
+	cd ${wrksrc}/build/qt
+	/usr/lib/qt6/bin/qmake ../../bitmask.pro \
+		VENDOR_PATH=providers/riseup \
+		TARGET=riseup-vpn \
+		RELEASE=yes \
+		QMAKE_CC=cc QMAKE_CXX=c++ QMAKE_LINK=c++
+}
+do_build() {
+	cd ${wrksrc}/build/qt
+	make ${makejobs}
+}
+do_install() {
+	cd ${wrksrc}
+	vbin build/qt/release/riseup-vpn
+	vbin helpers/bitmask-root
+	vinstall ${FILESDIR}/org.void.pkexec.bitmask-root.policy 644 /usr/share/polkit-1/actions
+	vinstall ${FILESDIR}/riseup-vpn.desktop 644 /usr/share/applications
+	vmkdir /usr/share/pixmaps
+	# Correct icon path inside riseup assets
+	vcopy providers/riseup/assets/icon.png /usr/share/pixmaps/riseup-vpn.png
+}