diff --git a/README.md b/README.md
index bae7217..385981c 100644
--- a/README.md
+++ b/README.md
@@ -74,6 +74,35 @@ the service user and group
 a variant of ghidra built with a headless openjdk, intended to reduce closure size for server
 operation
 
+## lib documentation
+
+### `fetchFromSteam`
+
+a fetcher that downloads binaries from [Steam](https://store.steampowered.com/) using
+[DepotDownloader](https://github.com/SteamRE/DepotDownloader). this is intended for game servers
+that are distributed via Steam. use [SteamDB](https://steamdb.info) to get the needed IDs.
+
+Usage:
+
+```nix
+pkgs.fetchFromSteam {
+  name = "..."; # optional
+  appId = "...";
+  depot = {
+    depotId = "...";
+    manifestId = "...";
+    beta = "..."; # optional
+  };
+
+  additionalDepots = [
+    # same format as the main `depot`
+    # use this to include eg the steamworks redistributable depot
+  ];
+
+  hash = pkgs.lib.fakeHash;
+}
+```
+
 ## licensing
 
 this repository is NOT licensed under a "standard" FOSS license. instead, it uses
diff --git a/default.nix b/default.nix
index 05a7378..0182ae5 100644
--- a/default.nix
+++ b/default.nix
@@ -7,6 +7,8 @@
 
   nixpkgs.overlays = [
     (final: prev: {
+      fetchFromSteam = prev.callPackage ./lib/fetchsteam {};
+
       ghidra_headless = prev.ghidra.override {
         openjdk17 = prev.openjdk17_headless;
       };
diff --git a/lib/fetchsteam/builder.sh b/lib/fetchsteam/builder.sh
new file mode 100644
index 0000000..617f2bd
--- /dev/null
+++ b/lib/fetchsteam/builder.sh
@@ -0,0 +1,13 @@
+if [ -e "$NIX_ATTRS_SH_FILE" ]; then . "$NIX_ATTRS_SH_FILE"; elif [ -f .attrs.sh ]; then . .attrs.sh; fi
+source $stdenv/setup
+echo "Downloading Steam depots for appId $appId into $out"
+
+export HOME="$PWD"
+mkdir -p "$out"
+
+for args in "${depotArgs[@]}"; do
+    echo "Downloading component: $args"
+    DepotDownloader $args -dir "$out" -validate
+done
+
+rm -rf "$out/.DepotDownloader"
diff --git a/lib/fetchsteam/default.nix b/lib/fetchsteam/default.nix
new file mode 100644
index 0000000..d633099
--- /dev/null
+++ b/lib/fetchsteam/default.nix
@@ -0,0 +1,50 @@
+{ lib, stdenvNoCC, system, cacert, depotdownloader }:
+let
+  checkDepot = depot: with builtins;
+    hasAttr "depotId" depot && hasAttr "manifestId" depot;
+  depotFormat = "{ depotId = ...; manifestId = ...; [beta = ...;] }";
+in lib.makeOverridable (
+{
+  name ? null,
+  appId,
+  depot,
+  additionalDepots ? [],
+  hash
+}:
+if ! checkDepot depot then
+  throw "Invalid format for depot: must be ${depotFormat}"
+else if ! builtins.all checkDepot additionalDepots then
+  throw "Invalid format for additionalDepots: must be ${depotFormat}"
+else
+let
+  depotOs =
+    if system == "x86_64-linux" then
+      "linux"
+    else
+      throw "fetchFromSteam does not currently support systems other than x86_64-linux";
+  makeDepotArg = depot:
+    "-app ${appId} -depot ${depot.depotId} -manifest ${depot.manifestId} -os ${depotOs}"
+    + (lib.optionalString (builtins.hasAttr "beta" depot) " -beta ${depot.beta}");
+  depotArgs = builtins.map makeDepotArg [ depot ] ++ additionalDepots;
+in stdenvNoCC.mkDerivation {
+  name = "steam-depot-${appId}" + (lib.optionalString (name != null) "-${name}");
+  builder = ./builder.sh;
+
+  inherit appId;
+  inherit depotArgs;
+
+  nativeBuildInputs = [
+    depotdownloader
+    cacert
+  ];
+  SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+  # impureEnvVars are not handled here
+  # if used in an environment with eg, an http proxy, consult DepotDownloader and/or .NET for how to
+  # configure that sort of thing
+
+  outputHashMode = "recursive";
+  outputHash = hash;
+
+  preferLocalBuild = true;
+})