diff --git a/modules/zabbix-agent.nix b/modules/zabbix-agent.nix
index 64edc65..e69ec37 100644
--- a/modules/zabbix-agent.nix
+++ b/modules/zabbix-agent.nix
@@ -1,9 +1,14 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
+let
+  version = "latest";
+in
 {
+
   services.zabbixAgent = {
     enable = true;
     server = "zabbix-server";
-    package = pkgs.zabbix.agent2;
+    #package = pkgs.zabbix.agent2;
+    package = (pkgs.callPackages ../packages/zabbix/agent2.nix {}).${version};
     settings = {
       UserParameter = [
       "systemd.exitstatus[*],systemctl show --value -p ExecMainStatus '$1'"
diff --git a/packages/zabbix/agent2.nix b/packages/zabbix/agent2.nix
new file mode 100644
index 0000000..1cda296
--- /dev/null
+++ b/packages/zabbix/agent2.nix
@@ -0,0 +1,67 @@
+{ lib, buildGoModule, fetchurl, autoreconfHook, pkg-config, libiconv, openssl, pcre, zlib }:
+
+import ./versions.nix ({ version, sha256 }:
+  buildGoModule {
+    pname = "zabbix-agent2";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix/sources/stable/${lib.versions.majorMinor version}/zabbix-${version}.tar.gz";
+      inherit sha256;
+    };
+
+    modRoot = "src/go";
+
+    #vendorSha256 = "1417qi061xc4m55z0vz420fr7qpi24kw5yj9wq7iic92smakgkjn";
+    vendorSha256 = "sha256-W95Z9pIhd5MQJAGn94kiVbQVFkmvjGPWfMx4JyJ2/EU=";
+
+    nativeBuildInputs = [ autoreconfHook pkg-config ];
+    buildInputs = [ libiconv openssl pcre zlib ];
+
+    inherit (buildGoModule.go) GOOS GOARCH;
+
+    # need to provide GO* env variables & patch for reproducibility
+    postPatch = ''
+      substituteInPlace src/go/Makefile.am \
+        --replace '`go env GOOS`' "$GOOS" \
+        --replace '`go env GOARCH`' "$GOARCH" \
+        --replace '`date +%H:%M:%S`' "00:00:00" \
+        --replace '`date +"%b %_d %Y"`' "Jan 1 1970"
+    '';
+
+    # manually configure the c dependencies
+    preConfigure = ''
+      ./configure \
+        --prefix=${placeholder "out"} \
+        --enable-agent2 \
+        --enable-ipv6 \
+        --with-iconv \
+        --with-libpcre \
+        --with-openssl=${openssl.dev}
+    '';
+
+    # zabbix build process is complex to get right in nix...
+    # use automake to build the go project ensuring proper access to the go vendor directory
+    buildPhase = ''
+      cd ../..
+      make
+    '';
+
+    installPhase = ''
+      mkdir -p $out/sbin
+
+      install -Dm0644 src/go/conf/zabbix_agent2.conf $out/etc/zabbix_agent2.conf
+      install -Dm0755 src/go/bin/zabbix_agent2 $out/bin/zabbix_agent2
+
+      # create a symlink which is compatible with the zabbixAgent module
+      ln -s $out/bin/zabbix_agent2 $out/sbin/zabbix_agentd
+    '';
+
+    meta = with lib; {
+      description = "An enterprise-class open source distributed monitoring solution (client-side agent)";
+      homepage = "https://www.zabbix.com/";
+      license = licenses.gpl2Plus;
+      maintainers = [ maintainers.aanderse ];
+      platforms = platforms.linux;
+    };
+  })
diff --git a/packages/zabbix/versions.nix b/packages/zabbix/versions.nix
new file mode 100644
index 0000000..af88364
--- /dev/null
+++ b/packages/zabbix/versions.nix
@@ -0,0 +1,16 @@
+generic: {
+  latest = generic {
+    version = "6.2.3";
+    sha256 = "sha256-K+flf7M6Vf7nFIBZjjF/+mqO5aOWOafhtCsupochB7U=";
+  };
+
+  v50 = generic {
+    version = "5.0.19";
+    sha256 = "sha256-esa7DczdaWiG8Ru9py8HlOhvhkjV8IQjMwuiJ6F5c6E=";
+  };
+
+  v40 = generic {
+    version = "4.0.37";
+    sha256 = "sha256-Wuexl8I2zA63jyTRDe8bMSP++imwSOxc4LEdUnH8jps=";
+  };
+}