diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix
index 8bc7d9282302..e4d65170f55b 100644
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ b/pkgs/by-name/pr/prometheus/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "3.13.0";
-  hash = "sha256-v6jk4MqoxcfK+yj+T31Ovqj1tyh3mc4aEr8BD0vjBOc=";
+  version = "3.13.1";
+  hash = "sha256-DtUdZp/o/tzLjiOZJ3duGqaLoNvkzulbL+wyLnY0dwA=";
   pnpmDepsHash = "sha256-Z1TYYZhELi+rIiuleN8xR/WiMn9TF4KotFMTOsR2e6Y=";
   vendorHash = "sha256-yvzQHfe7yd6Sjh1Vd2VxTp3jK8OWoKTmJ2uMyXX3+xs=";
 }
diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh
index 2f3b54b8aed4..489a092aac61 100755
--- a/pkgs/by-name/pr/prometheus/update.sh
+++ b/pkgs/by-name/pr/prometheus/update.sh
@@ -49,9 +49,22 @@ cat > "$SOURCE_NIX" <<-EOF
 }
 EOF
 
-VENDOR_HASH=$(extractHash prometheus.goModules)
+# Resolve pnpm hash first: the Go integration pulls in the assets, so a fake
+# pnpmDepsHash makes that stage fail.
 PNPM_DEPS_HASH=$(extractHash prometheus.assets.pnpmDeps)
 
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  pnpmDepsHash = "$PNPM_DEPS_HASH";
+  vendorHash = "$FAKE_HASH";
+}
+EOF
+
+# Now do the Go module fetch.
+VENDOR_HASH=$(extractHash prometheus.goModules)
+
 cat > "$SOURCE_NIX" <<-EOF
 {
   version = "$TARGET_VERSION";