diff --git a/horizon.dhall b/horizon.dhall
index 2588c16032598a5f3d144754dc15948b8bbd1057..703769ff1b60be9c2c3ac1f9212971a6a094a215 100644
--- a/horizon.dhall
+++ b/horizon.dhall
@@ -42,6 +42,7 @@ let packages =
           H.callHackage "autodocodec-servant-multipart" "0.0.0.0"
       , autoexporter = H.callHackage "autoexporter" "2.0.0.9"
       , base-prelude = H.callHackage "base-prelude" "1.6.1.1"
+      , base32 = H.callHackage "base32" "0.4"
       , base58-bytestring = H.callHackage "base58-bytestring" "0.1.0"
       , base64 = H.callHackage "base64" "0.4.2.4"
       , base64-bytestring = H.callHackage "base64-bytestring" "1.2.1.0"
@@ -396,6 +397,7 @@ let packages =
       , language-c = H.callHackage "language-c" "0.9.2"
       , lazy-search = H.callHackage "lazy-search" "0.1.3.0"
       , lazysmallcheck = H.callHackage "lazysmallcheck" "0.6"
+      , libsodium-bindings = H.callHackage "libsodium-bindings" "0.0.1.1"
       , libsystemd-journal = H.callHackage "libsystemd-journal" "1.4.5.1"
       , linear-base = H.callHackage "linear-base" "0.4.0"
       , linear-generics = H.callHackage "linear-generics" "0.2.2"
@@ -475,6 +477,7 @@ let packages =
             "411d5d0aaeeb96d4b72d0a434b9d2b53c88c2eae"
             (None H.Subdir)
       , one-liner = H.callHackage "one-liner" "2.1"
+      , one-time-password = H.callHackage "one-time-password" "2.0.0"
       , openapi3 = H.callHackage "openapi3" "3.2.4"
       , openssl-streams = H.callHackage "openssl-streams" "1.2.3.0"
       , opentelemetry = H.callHackage "opentelemetry" "0.8.0"
@@ -571,6 +574,11 @@ let packages =
       , sandwich = H.callHackage "sandwich" "0.2.1.0"
       , say = H.callHackage "say" "0.1.0.1"
       , scotty = H.callHackage "scotty" "0.20.1"
+      , sel =
+          H.callGit
+            "https://github.com/haskell-cryptography/libsodium-bindings"
+            "1cc2049b7eceb02c28cc4e9390bdf86b8914941a"
+            (Some "sel/")
       , selective = H.callHackage "selective" "0.7"
       , semver = H.callHackage "semver" "0.4.0.1"
       , servant-auth = H.callHackage "servant-auth" "0.4.1.0"
diff --git a/horizon.lock b/horizon.lock
index 80a329a44469b08de437df11b1f1139c609ba491..10c1a97f4fd549d2adcdfed47e64f0a38adf9a86 100644
--- a/horizon.lock
+++ b/horizon.lock
@@ -154,6 +154,10 @@
   , mapValue =
       "36a97e4d334dbe3435d0c59bd9906d70b3743d75faa3ac1e5c8abc2ad3ab846b"
   }
+, { mapKey = "base32"
+  , mapValue =
+      "ddbb3f0de62690db7a15ebdc073b051dfc460f0c13cade6a8eed6fd79fa1d712"
+  }
 , { mapKey = "base58-bytestring"
   , mapValue =
       "cbd788e318dd1d3e1a326a156fcc99a636256d8cd027ff71fc1d54d5847e0add"
@@ -1194,6 +1198,10 @@
   , mapValue =
       "96f56a2fca941a982f3ba55672bbc7d07d2a6f619d8d79b11f85de8c953b1442"
   }
+, { mapKey = "libsodium-bindings"
+  , mapValue =
+      "589ed621c729f1c864097f7abf2e52d3ff5553225859e8f8db9620745983978e"
+  }
 , { mapKey = "libsystemd-journal"
   , mapValue =
       "4c23a1ba03f249e09c2955e422a8b5c97276e742f98694b7e6e9de129cfed6ca"
@@ -1438,6 +1446,10 @@
   , mapValue =
       "a8335a38332725f58738191583e9381d6090780b3f48146ee43ddbb2b002ab3a"
   }
+, { mapKey = "one-time-password"
+  , mapValue =
+      "f9b51a0547027e171bb44960efa8269c53e35598dd6e55d5741892495cb3d4ae"
+  }
 , { mapKey = "openapi3"
   , mapValue =
       "400c3e13458d1d10809abe2a07280c9d05cc116dd4467e5e2bf3e54d8eefebc3"
@@ -1774,6 +1786,10 @@
   , mapValue =
       "5342ba95101b2d2a54fe29e41fb2a26a50ef5579a4901a71243b37689bbe7665"
   }
+, { mapKey = "sel"
+  , mapValue =
+      "5db1ad43c2949aa68542d03e324a8a13b55ceecf6905d39d875d6374dc6a2dd6"
+  }
 , { mapKey = "selective"
   , mapValue =
       "ff2ea0cc2e682232e107692f159fbeafae4b9083f72af469355f00caf33e3b60"
diff --git a/overlay.nix b/overlay.nix
index 646d0ed8663126ac54024373199c1cacfa8c111f..2a300868bdf6d02b5cfed6e4c5d84e35b9c1ec76 100644
--- a/overlay.nix
+++ b/overlay.nix
@@ -79,6 +79,8 @@ final: prev: with pkgs.haskell.lib; {
 
   base-prelude = final.callPackage (./pkgs/base-prelude.nix) { };
 
+  base32 = final.callPackage (./pkgs/base32.nix) { };
+
   base58-bytestring = final.callPackage (./pkgs/base58-bytestring.nix) { };
 
   base64 = final.callPackage (./pkgs/base64.nix) { };
@@ -599,6 +601,8 @@ final: prev: with pkgs.haskell.lib; {
 
   lazysmallcheck = final.callPackage (./pkgs/lazysmallcheck.nix) { };
 
+  libsodium-bindings = final.callPackage (./pkgs/libsodium-bindings.nix) { };
+
   libsystemd-journal = final.callPackage (./pkgs/libsystemd-journal.nix) { };
 
   linear-base = final.callPackage (./pkgs/linear-base.nix) { };
@@ -721,6 +725,8 @@ final: prev: with pkgs.haskell.lib; {
 
   one-liner = final.callPackage (./pkgs/one-liner.nix) { };
 
+  one-time-password = final.callPackage (./pkgs/one-time-password.nix) { };
+
   openapi3 = final.callPackage (./pkgs/openapi3.nix) { };
 
   openssl-streams = final.callPackage (./pkgs/openssl-streams.nix) { };
@@ -889,6 +895,8 @@ final: prev: with pkgs.haskell.lib; {
 
   scotty = final.callPackage (./pkgs/scotty.nix) { };
 
+  sel = final.callPackage (./pkgs/sel.nix) { };
+
   selective = final.callPackage (./pkgs/selective.nix) { };
 
   semver = final.callPackage (./pkgs/semver.nix) { };
diff --git a/pkgs/base32.nix b/pkgs/base32.nix
new file mode 100644
index 0000000000000000000000000000000000000000..7c758c421e3b29a6ced1fea5dd93704e1e7e161b
--- /dev/null
+++ b/pkgs/base32.nix
@@ -0,0 +1,33 @@
+{ mkDerivation, QuickCheck, base, bytestring, criterion, deepseq
+, lib, memory, random-bytestring, tasty, tasty-hunit
+, tasty-quickcheck, text, text-short
+}:
+mkDerivation {
+  pname = "base32";
+  version = "0.4";
+  sha256 = "9ae7861d509528d3e8f4ecd946051b05f7141e907216e672d18e26d242a908d4";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    base bytestring deepseq text text-short
+  ];
+  testHaskellDepends = [
+    base bytestring memory QuickCheck random-bytestring tasty
+    tasty-hunit tasty-quickcheck text text-short
+  ];
+  benchmarkHaskellDepends = [
+    base bytestring criterion deepseq memory random-bytestring text
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = true;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "https://github.com/emilypi/base32";
+  description = "Fast RFC 4648-compliant Base32 encoding";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
\ No newline at end of file
diff --git a/pkgs/libsodium-bindings.nix b/pkgs/libsodium-bindings.nix
new file mode 100644
index 0000000000000000000000000000000000000000..15f25d947fc5b07f66ab721d625bc2264123ebab
--- /dev/null
+++ b/pkgs/libsodium-bindings.nix
@@ -0,0 +1,22 @@
+{ mkDerivation, base, lib, libsodium }:
+mkDerivation {
+  pname = "libsodium-bindings";
+  version = "0.0.1.1";
+  sha256 = "aaada3df0291c982ee4d65975ad0332aa6cb72875c7d0feb5023d07c08d7d33d";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [ base ];
+  librarySystemDepends = [ libsodium ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = true;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "https://github.com/haskell-cryptography/libsodium-bindings";
+  description = "FFI bindings to libsodium";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
\ No newline at end of file
diff --git a/pkgs/one-time-password.nix b/pkgs/one-time-password.nix
new file mode 100644
index 0000000000000000000000000000000000000000..537a0a7f622454ed2cbb4b626a861cc72179365f
--- /dev/null
+++ b/pkgs/one-time-password.nix
@@ -0,0 +1,28 @@
+{ mkDerivation, base, bytestring, cereal, cryptonite, lib, memory
+, tasty, tasty-hunit, time
+}:
+mkDerivation {
+  pname = "one-time-password";
+  version = "2.0.0";
+  sha256 = "0a35ba546367070cbef67b80fc1e4eea3df5df3e683d3422873fa13a2b2bf9a2";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    base bytestring cereal cryptonite memory time
+  ];
+  testHaskellDepends = [
+    base bytestring cryptonite tasty tasty-hunit time
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = true;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "https://github.com/s9gf4ult/one-time-password";
+  description = "HMAC-Based and Time-Based One-Time Passwords";
+  license = lib.licenses.mit;
+  broken = false;
+}
\ No newline at end of file
diff --git a/pkgs/sel.nix b/pkgs/sel.nix
new file mode 100644
index 0000000000000000000000000000000000000000..e40059d0a31ad9757f9a9d9205d6c7dabb16a070
--- /dev/null
+++ b/pkgs/sel.nix
@@ -0,0 +1,35 @@
+{ mkDerivation, base, base16, bytestring, fetchgit, hedgehog, lib
+, libsodium-bindings, tasty, tasty-hunit, text, text-display
+}:
+mkDerivation {
+  pname = "sel";
+  version = "0.0.1.0";
+  src = fetchgit {
+    url = "https://github.com/haskell-cryptography/libsodium-bindings";
+    sha256 = "0r7mn8800gpqc2p96lxsxm7xjbrkq5sdiybj8fqil9inw2w3n445";
+    rev = "1cc2049b7eceb02c28cc4e9390bdf86b8914941a";
+    fetchSubmodules = true;
+  };
+  postUnpack = "sourceRoot+=/sel/; echo source root reset to $sourceRoot";
+  isLibrary = true;
+  isExecutable = false;
+  enableSeparateDataOutput = false;
+  libraryHaskellDepends = [
+    base base16 bytestring libsodium-bindings text text-display
+  ];
+  testHaskellDepends = [
+    base base16 bytestring hedgehog libsodium-bindings tasty
+    tasty-hunit text
+  ];
+  enableLibraryProfiling = true;
+  enableExecutableProfiling = true;
+  doHaddock = true;
+  jailbreak = true;
+  doCheck = false;
+  doBenchmark = false;
+  hyperlinkSource = false;
+  homepage = "https://github.com/haskell-cryptography/libsodium-bindings";
+  description = "Cryptography for the casual user";
+  license = lib.licenses.bsd3;
+  broken = false;
+}
\ No newline at end of file