diff --git a/nginx-mainline.yaml b/nginx-mainline.yaml
index a55f15a94a99..38cff7cba68c 100644
--- a/nginx-mainline.yaml
+++ b/nginx-mainline.yaml
@@ -3,7 +3,7 @@ package:
   # MAINLINE VERSIONS MUST USE ODD MINOR VERSIONS (e.g., 1.27.x, 1.29.x)
   # Must also bump njs at the same time
   version: "1.29.8"
-  epoch: 1
+  epoch: 2
   # HEY YOU! If you update/bump this package you NEED to go and update the equivilent nginx-otel package
   description: HTTP and reverse proxy server (mainline version)
   copyright:
@@ -42,6 +42,7 @@ environment:
       - libxml2-dev
       - libxslt-dev
       - luajit-dev
+      - ngx_brotli
       - openssl-hardened-dev
       - pcre2-dev
       - perl-dev
@@ -58,6 +59,8 @@ var-transforms:
 data:
   - name: modules
     items:
+      http_brotli_filter: "10"
+      http_brotli_static: "10"
       http_geoip: "10"
       http_image_filter: "10"
       http_perl: "10"
@@ -139,7 +142,8 @@ pipeline:
           --with-stream_ssl_module \
           --with-stream_realip_module \
           --with-stream_geoip_module=dynamic \
-          --with-stream_ssl_preread_module
+          --with-stream_ssl_preread_module \
+          --add-dynamic-module=/usr/src/ngx_brotli
 
   - working-directory: nginx-mainline
     runs: |
diff --git a/nginx-stable.yaml b/nginx-stable.yaml
index 1356e2410cea..5fa028fc355e 100644
--- a/nginx-stable.yaml
+++ b/nginx-stable.yaml
@@ -2,7 +2,7 @@ package:
   name: nginx-stable
   # STABLE VERSIONS MUST USE EVEN MINOR VERSIONS (e.g., 1.26.x, 1.28.x)
   version: "1.28.3"
-  epoch: 1
+  epoch: 2
   # HEY YOU! If you update/bump this package you NEED to go and update the equivilent nginx-otel package
   description: HTTP and reverse proxy server (stable version)
   copyright:
@@ -38,6 +38,7 @@ environment:
       - libxml2-dev
       - libxslt-dev
       - luajit-dev
+      - ngx_brotli
       - openssl-hardened-dev
       - pcre-dev
       - perl-dev
@@ -54,6 +55,8 @@ var-transforms:
 data:
   - name: modules
     items:
+      http_brotli_filter: "10"
+      http_brotli_static: "10"
       http_geoip: "10"
       http_image_filter: "10"
       http_perl: "10"
@@ -138,7 +141,8 @@ pipeline:
           --with-stream_ssl_module \
           --with-stream_realip_module \
           --with-stream_geoip_module=dynamic \
-          --with-stream_ssl_preread_module
+          --with-stream_ssl_preread_module \
+          --add-dynamic-module=/usr/src/ngx_brotli
 
   - working-directory: nginx-stable
     runs: |
diff --git a/ngx_brotli.yaml b/ngx_brotli.yaml
new file mode 100644
index 000000000000..e19a3bacb13c
--- /dev/null
+++ b/ngx_brotli.yaml
@@ -0,0 +1,41 @@
+package:
+  name: ngx_brotli
+  version: "1.0.0_p20231009"
+  epoch: 0
+  description: Nginx module for Brotli compression (source tree for dynamic module builds)
+  copyright:
+    - license: BSD-2-Clause
+  dependencies:
+    runtime:
+      - wolfi-baselayout
+
+environment:
+  contents:
+    packages:
+      - busybox
+      - ca-certificates-bundle
+
+pipeline:
+  - uses: git-checkout
+    with:
+      repository: https://github.com/google/ngx_brotli.git
+      branch: master
+      expected-commit: a71f9312c2deb28875acc7bacfdd5695a111aa53
+      destination: ngx_brotli
+
+  - runs: |
+      mkdir -p ${{targets.destdir}}/usr/src/ngx_brotli
+      cp -r ngx_brotli/. ${{targets.destdir}}/usr/src/ngx_brotli/
+      # drop git metadata; consumers only need the source tree
+      rm -rf ${{targets.destdir}}/usr/src/ngx_brotli/.git
+
+test:
+  pipeline:
+    - uses: test/tw/srcpackage
+
+update:
+  enabled: false
+  exclude-reason: >
+    Upstream google/ngx_brotli is effectively frozen; last commit
+    was in October 2023. Pin is bumped manually when a newer nginx
+    release requires it.