diff --git a/modules/sq/1.4.0.envoy/MODULE.bazel b/modules/sq/1.4.0.envoy/MODULE.bazel
new file mode 100644
index 0000000..cff13c5
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/MODULE.bazel
@@ -0,0 +1,32 @@
+module(
+    name = "sq",
+    version = "1.4.0.envoy",
+    compatibility_level = 1,
+)
+
+bazel_dep(name = "platforms", version = "1.0.0")
+bazel_dep(name = "rules_rust", version = "0.69.0.envoy")
+
+rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
+rust.toolchain(
+    edition = "2021",
+    versions = ["1.85.0"],
+)
+use_repo(rust, "rust_toolchains")
+register_toolchains("@rust_toolchains//:all")
+
+crate = use_extension("@rules_rust//crate_universe:extensions.bzl", "crate")
+crate.annotation(
+    crate = "sequoia-openpgp",
+    crate_features = [
+        "crypto-rust",
+        "allow-experimental-crypto",
+        "allow-variable-time-crypto",
+    ],
+)
+crate.from_cargo(
+    name = "sequoia_sq_crate_index",
+    cargo_lockfile = "//:Cargo.lock",
+    manifests = ["//:Cargo.toml"],
+)
+use_repo(crate, "sequoia_sq_crate_index")
diff --git a/modules/sq/1.4.0.envoy/overlay/BUILD.bazel b/modules/sq/1.4.0.envoy/overlay/BUILD.bazel
new file mode 100644
index 0000000..f70b4d9
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/overlay/BUILD.bazel
@@ -0,0 +1,20 @@
+load("@rules_rust//rust:defs.bzl", "rust_binary")
+load("@sequoia_sq_crate_index//:defs.bzl", "aliases", "all_crate_deps")
+
+package(default_visibility = ["//visibility:public"])
+
+rust_binary(
+    name = "sq",
+    srcs = glob(["src/**/*.rs"]),
+    aliases = aliases(),
+    compile_data = ["README.md"],
+    crate_features = [
+        "crypto-rust",
+        "allow-experimental-crypto",
+        "allow-variable-time-crypto",
+    ],
+    crate_root = "src/main.rs",
+    edition = "2021",
+    proc_macro_deps = all_crate_deps(proc_macro = True),
+    deps = all_crate_deps(normal = True),
+)
diff --git a/modules/sq/1.4.0.envoy/patches/sq-default-crypto-rust.patch b/modules/sq/1.4.0.envoy/patches/sq-default-crypto-rust.patch
new file mode 100644
index 0000000..2a5967b
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/patches/sq-default-crypto-rust.patch
@@ -0,0 +1,13 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index 5292d9c..4f5ce94 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -113,7 +113,7 @@ required-features = ["subplot"]
+ 
+ [features]
+ default = [
+-    "crypto-nettle",
++    "crypto-rust",
+ ]
+ crypto-nettle = ["sequoia-openpgp/crypto-nettle"]
+ crypto-openssl = ["sequoia-openpgp/crypto-openssl"]
diff --git a/modules/sq/1.4.0.envoy/presubmit.yml b/modules/sq/1.4.0.envoy/presubmit.yml
new file mode 100644
index 0000000..ed230b7
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/presubmit.yml
@@ -0,0 +1,15 @@
+matrix:
+  platform:
+  - ubuntu2404
+  - debian11
+  - macos
+  bazel:
+  - 8.x
+
+tasks:
+  verify_targets:
+    name: Verify build targets
+    platform: ${{ platform }}
+    bazel: ${{ bazel }}
+    build_targets:
+    - '@sq//:sq'
diff --git a/modules/sq/1.4.0.envoy/source.json b/modules/sq/1.4.0.envoy/source.json
new file mode 100644
index 0000000..922d00f
--- /dev/null
+++ b/modules/sq/1.4.0.envoy/source.json
@@ -0,0 +1,12 @@
+{
+  "url": "https://gitlab.com/sequoia-pgp/sequoia-sq/-/archive/v1.4.0/sequoia-sq-v1.4.0.tar.gz",
+  "integrity": "sha256-yFa/sPDJShuPS3KgSm7/Hh09JMN3ywseSVaI6arYRno=",
+  "strip_prefix": "sequoia-sq-v1.4.0",
+  "patch_strip": 1,
+  "patches": {
+    "sq-default-crypto-rust.patch": "sha256-HDXDp3D8mE8QmN00Cra6HG4Dz6/DyEEIe83fgIYqk5g="
+  },
+  "overlay": {
+    "BUILD.bazel": "sha256-Z9gyfFWekCqZ6/GuCTtVcDIgtpHoE9UQISHjI4qX3s8="
+  }
+}
diff --git a/modules/sq/metadata.json b/modules/sq/metadata.json
new file mode 100644
index 0000000..4df3765
--- /dev/null
+++ b/modules/sq/metadata.json
@@ -0,0 +1,16 @@
+{
+  "homepage": "https://sequoia-pgp.org",
+  "maintainers": [
+    {
+      "name": "Envoy maintainers",
+      "github": "envoyproxy"
+    }
+  ],
+  "repository": [
+    "gitlab:sequoia-pgp/sequoia-sq"
+  ],
+  "versions": [
+    "1.4.0.envoy"
+  ],
+  "yanked_versions": {}
+}