diff --git a/home/cli.nix b/home/cli.nix
index d43946e..693686b 100644
--- a/home/cli.nix
+++ b/home/cli.nix
@@ -43,6 +43,10 @@
 
     # x402 / MPP agentic payments CLI (Solana Foundation)
     (pkgs.callPackage ./pay.nix {})
+
+    # Python (системный 3.9 macOS — слишком старый; ставим 3.13 через nix)
+    python313
+    uv
   ];
 
   # TODO: global npm/pnpm packages not managed by nix for now
diff --git a/home/pay.nix b/home/pay.nix
new file mode 100644
index 0000000..2c4f884
--- /dev/null
+++ b/home/pay.nix
@@ -0,0 +1,76 @@
+# pay — official Solana Foundation CLI for x402 / MPP payments.
+# Source: https://github.com/solana-foundation/pay  (Rust, but we use upstream prebuilt binaries)
+#
+# Not in nixpkgs yet (fresh project). This derivation fetches the upstream
+# prebuilt binary tarball per platform. Update `version` + hashes on bump.
+{
+  stdenv,
+  fetchurl,
+  lib,
+  system ? builtins.currentSystem,
+}:
+let
+  version = "0.21.0";
+  tag = "pay-v${version}";
+
+  # platform -> (tarball name, sha256 of the tarball)
+  # Only fill hashes for platforms you actually target; others fall through to meta.broken.
+  srcInfo =
+    {
+      "aarch64-darwin" = {
+        name = "pay-aarch64-apple-darwin.tar.gz";
+        hash = "11c96191145381fea9c938969c14bbd6424bcdf51ef119374c4905fb51d0e265";
+      };
+      "x86_64-darwin" = {
+        name = "pay-x86_64-apple-darwin.tar.gz";
+        hash = lib.fakeSha256; # fill if needed
+      };
+      "aarch64-linux" = {
+        name = "pay-aarch64-unknown-linux-gnu.tar.gz";
+        hash = lib.fakeSha256; # fill if needed
+      };
+      "x86_64-linux" = {
+        name = "pay-x86_64-unknown-linux-gnu.tar.gz";
+        hash = lib.fakeSha256; # fill if needed
+      };
+    }
+    .${system} or (throw "pay: no prebuilt binary for system ${system}");
+in
+stdenv.mkDerivation {
+  pname = "pay";
+  inherit version;
+
+  src = fetchurl {
+    url = "https://github.com/solana-foundation/pay/releases/download/${tag}/${srcInfo.name}";
+    # hex sha256 (verified locally for aarch64-darwin tarball)
+    sha256 = srcInfo.hash;
+  };
+
+  sourceRoot = ".";
+
+  # tarball contains a single prebuilt `pay` binary at its root.
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 pay $out/bin/pay
+    runHook postInstall
+  '';
+
+  # Upstream prebuilt; we trust the platform toolchain, no further stripping/patching needed.
+  dontStrip = true;
+  dontPatchELF = true;
+
+  meta = {
+    description = "Solana Foundation CLI for x402 / MPP agentic API payments";
+    homepage = "https://pay.sh/";
+    license = lib.licenses.mit;
+    mainProgram = "pay";
+    # Known-good prebuilts; add hashes above to enable more platforms.
+    platforms = lib.platforms.darwin ++ lib.platforms.linux;
+    badPlatforms = [
+      # explicit hashes still fakeHash -> nix will fail to build on these, which is fine
+    ];
+  };
+}