diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index b3bbdf9485ac..e543f57bb010 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -143,6 +143,11 @@ checkConfigError 'A definition for option .* is not of type.*positive integer.*.
 checkConfigOutput '^42$' config.value ./declare-int-between-value.nix ./define-value-int-positive.nix
 checkConfigError 'A definition for option .* is not of type.*between.*-21 and 43.*inclusive.*. Definition values:\n\s*- In .*: -23' config.value ./declare-int-between-value.nix ./define-value-int-negative.nix
 
+# Check hex string type
+# types.hexStr
+checkConfigOutput '^"64075c"$' config.value ./declare-hex-value.nix ./define-value-is-hex.nix
+checkConfigError 'A definition for option .* is not of type.*hexadecimal value represented as string.*. Definition values:\n\s*- In .*: "notAhex"' config.value ./declare-hex-value.nix ./define-value-not-hex.nix
+
 # Check either types
 # types.either
 checkConfigOutput '^42$' config.value ./declare-either.nix ./define-value-int-positive.nix
diff --git a/lib/tests/modules/declare-hex-value.nix b/lib/tests/modules/declare-hex-value.nix
new file mode 100644
index 000000000000..0cf3569c6da2
--- /dev/null
+++ b/lib/tests/modules/declare-hex-value.nix
@@ -0,0 +1,9 @@
+{ lib, ... }:
+
+{
+  options = {
+    value = lib.mkOption {
+      type = lib.types.hexStr;
+    };
+  };
+}
diff --git a/lib/tests/modules/define-value-is-hex.nix b/lib/tests/modules/define-value-is-hex.nix
new file mode 100644
index 000000000000..0e187e87c81d
--- /dev/null
+++ b/lib/tests/modules/define-value-is-hex.nix
@@ -0,0 +1,3 @@
+{
+  value = "64075c";
+}
diff --git a/lib/tests/modules/define-value-not-hex.nix b/lib/tests/modules/define-value-not-hex.nix
new file mode 100644
index 000000000000..fc387a85eb40
--- /dev/null
+++ b/lib/tests/modules/define-value-not-hex.nix
@@ -0,0 +1,3 @@
+{
+  value = "notAhex";
+}
diff --git a/lib/types.nix b/lib/types.nix
index 12bf18633e3a..c7ba8e955678 100644
--- a/lib/types.nix
+++ b/lib/types.nix
@@ -373,6 +373,14 @@ rec {
       merge = mergeEqualOption;
     };
 
+    hexStr = mkOptionType {
+      name = "hexStr";
+      description = "hexadecimal value represented as string";
+      descriptionClass = "noun";
+      check = x: str.check x && builtins.match "[0-9a-f]+" x != null;
+      merge = mergeEqualOption;
+    };
+
     number = either int float;
 
     numbers = let
diff --git a/nixos/doc/manual/development/option-types.section.md b/nixos/doc/manual/development/option-types.section.md
index 243039b01673..f6fd74dd9c01 100644
--- a/nixos/doc/manual/development/option-types.section.md
+++ b/nixos/doc/manual/development/option-types.section.md
@@ -202,6 +202,12 @@ merging is handled.
 
 :   A string. Multiple definitions are concatenated with a colon `":"`.
 
+`types.hexStr`
+
+:   A hexadecimal value represented as string. The type only allows lowercase
+    values. The type also does not allow for hex prefixes like `0x` or `#`.
+
+
 `types.strMatching`
 
 :   A string matching a specific regular expression. Multiple