diff --git a/jobspec2/functions.go b/jobspec2/functions.go
index 2dd0f262098d..6cb0949a39aa 100644
--- a/jobspec2/functions.go
+++ b/jobspec2/functions.go
@@ -105,6 +105,7 @@ func Functions(basedir string, allowFS bool) map[string]function.Function {
 		"basename":   guardFS(allowFS, filesystem.BasenameFunc),
 		"dirname":    guardFS(allowFS, filesystem.DirnameFunc),
 		"file":       guardFS(allowFS, filesystem.MakeFileFunc(basedir, false)),
+		"filebase64": guardFS(allowFS, filesystem.MakeFileFunc(basedir, true)),
 		"fileexists": guardFS(allowFS, filesystem.MakeFileExistsFunc(basedir)),
 		"fileset":    guardFS(allowFS, filesystem.MakeFileSetFunc(basedir)),
 		"pathexpand": guardFS(allowFS, filesystem.PathExpandFunc),
diff --git a/website/content/docs/job-specification/hcl2/functions/file/filebase64.mdx b/website/content/docs/job-specification/hcl2/functions/file/filebase64.mdx
new file mode 100644
index 000000000000..9e9c0ddfc118
--- /dev/null
+++ b/website/content/docs/job-specification/hcl2/functions/file/filebase64.mdx
@@ -0,0 +1,37 @@
+---
+layout: docs
+page_title: filebase64 - Functions - Configuration Language
+description: |-
+  The filebase64 function reads the contents of the file at the given path and
+  returns them as a base64-encoded string.
+---
+
+# `filebase64` Function
+
+`filebase64` reads the contents of a file at the given path and returns them as
+a base64-encoded string.
+
+```hcl
+filebase64(path)
+```
+
+The result is a Base64 representation of the raw bytes in the given file.
+
+Nomad uses the "standard" Base64 alphabet as defined in
+[RFC 4648 section 4](https://tools.ietf.org/html/rfc4648#section-4).
+
+## Examples
+
+```
+> filebase64("${path.module}/hello.txt")
+SGVsbG8gV29ybGQ=
+```
+
+## Related Functions
+
+* [`file`](/docs/job-specification/hcl2/functions/file/file) also reads the contents of a given file,
+  but interprets the data as UTF-8 text and returns the result directly
+  as a string, without any further encoding.
+* [`base64decode`](/docs/job-specification/hcl2/functions/encoding/base64decode) can decode a
+  Base64 string representing bytes in UTF-8, but in practice `base64decode(filebase64(...))`
+  is equivalent to the shorter expression `file(...)`.
diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json
index 9985a84d995d..c3af8a827cc5 100644
--- a/website/data/docs-nav-data.json
+++ b/website/data/docs-nav-data.json
@@ -1044,6 +1044,10 @@
                     "title": "file",
                     "path": "job-specification/hcl2/functions/file/file"
                   },
+                  {
+                    "title": "filebase64",
+                    "path": "job-specification/hcl2/functions/file/filebase64"
+                  },
                   {
                     "title": "fileexists",
                     "path": "job-specification/hcl2/functions/file/fileexists"