diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6125c6a..0d3492b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,6 +12,7 @@ jobs:
     strategy:
       matrix:
         features:
+          - 1password-cli
           - actionlint
           - elixir-project
           - google-cloud-cli
diff --git a/src/1password-cli/README.md b/src/1password-cli/README.md
new file mode 100644
index 0000000..8b3f9df
--- /dev/null
+++ b/src/1password-cli/README.md
@@ -0,0 +1,30 @@
+# 1password-cli
+
+Install the [1Password CLI](https://developer.1password.com/docs/cli/) (`op`) from 1Password's signed apt repository.
+
+## Usage
+
+```json
+"features": {
+  "ghcr.io/CargoSense/devcontainer-features/1password-cli:1": {}
+}
+```
+
+## Options
+
+This Feature has no options. It installs the latest `1password-cli` package.
+
+## Signing in
+
+The 1Password desktop app's CLI integration does not reach into a container, so `op` signs in with your account details instead:
+
+```sh
+op account add --address <your-team>.1password.com --email <you@example.com>   # once; asks for your Secret Key and password
+eval "$(op signin)"                                                            # in each terminal that needs it
+```
+
+`op account add` stores the account in `~/.config/op`. Mount a named volume there (for example `type=volume,source=op-config,target=/home/vscode/.config/op`, owned by the remote user) to keep it across rebuilds.
+
+## OS Support
+
+This Feature should work on recent versions of Debian/Ubuntu and Linux distributions using the [apt](https://wiki.debian.org/AptCLI) management tool, on `amd64` and `arm64`.
diff --git a/src/1password-cli/devcontainer-feature.json b/src/1password-cli/devcontainer-feature.json
new file mode 100644
index 0000000..1f7d7c1
--- /dev/null
+++ b/src/1password-cli/devcontainer-feature.json
@@ -0,0 +1,12 @@
+{
+  "name": "1Password CLI",
+  "id": "1password-cli",
+  "version": "1.0.0",
+  "description": "Install the 1Password CLI (op) from 1Password's signed apt repository.",
+  "documentationURL": "https://github.com/CargoSense/devcontainer-features/tree/main/src/1password-cli",
+  "licenseURL": "https://github.com/CargoSense/devcontainer-features/blob/main/LICENSE",
+  "installsAfter": [
+    "ghcr.io/devcontainers/features/common-utils",
+    "ghcr.io/CargoSense/devcontainer-features/apt-packages"
+  ]
+}
diff --git a/src/1password-cli/install.sh b/src/1password-cli/install.sh
new file mode 100755
index 0000000..3a442df
--- /dev/null
+++ b/src/1password-cli/install.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env sh
+
+# Installs op from 1Password's apt repository, following
+# https://developer.1password.com/docs/cli/get-started/ (Debian/Ubuntu),
+# including the debsig policy that verifies the package signature.
+
+set -e
+
+if [ "$(id -u)" -ne 0 ]; then
+  printf 'Script must be run as root. Use sudo, su, or add "USER root" to your Dockerfile before running this script.'
+  exit 1
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+
+curl_installed=""
+gpg_installed=""
+
+if ! type curl >/dev/null 2>&1; then
+  apt-get update --yes
+  apt-get install --no-install-recommends --yes curl ca-certificates
+
+  curl_installed="true"
+fi
+
+if ! type gpg >/dev/null 2>&1; then
+  apt-get update --yes
+  apt-get install --no-install-recommends --yes gpg
+
+  gpg_installed="true"
+fi
+
+arch="$(dpkg --print-architecture)"
+key_url="https://downloads.1password.com/linux/keys/1password.asc"
+
+curl -fsSL "${key_url}" | gpg --dearmor --yes --output /usr/share/keyrings/1password-archive-keyring.gpg
+echo "deb [arch=${arch} signed-by=/usr/share/keyrings/1password-archive-keyring.gpg] https://downloads.1password.com/linux/debian/${arch} stable main" \
+  > /etc/apt/sources.list.d/1password.list
+
+mkdir -p /etc/debsig/policies/AC2D62742012EA22 /usr/share/debsig/keyrings/AC2D62742012EA22
+curl -fsSL https://downloads.1password.com/linux/debian/debsig/1password.pol \
+  > /etc/debsig/policies/AC2D62742012EA22/1password.pol
+curl -fsSL "${key_url}" | gpg --dearmor --yes --output /usr/share/debsig/keyrings/AC2D62742012EA22/debsig.gpg
+
+apt-get update --yes
+apt-get install --no-install-recommends --yes 1password-cli
+
+if [ -n "${curl_installed}" ]; then
+  apt purge curl --autoremove --yes
+fi
+
+if [ -n "${gpg_installed}" ]; then
+  apt purge gpg --autoremove --yes
+fi
+
+rm -rf /var/lib/apt/lists/*
+
+op --version
diff --git a/test/1password-cli/test.sh b/test/1password-cli/test.sh
new file mode 100755
index 0000000..c427402
--- /dev/null
+++ b/test/1password-cli/test.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -e
+
+# Optional: Import test library bundled with the devcontainer CLI
+# shellcheck source=/dev/null
+source dev-container-features-test-lib
+
+# Feature-specific tests
+check "version" op --version
+check "which op" bash -c "which op | grep /usr/bin/op"
+
+# Report result
+reportResults