diff --git a/pkgs/by-name/st/stockfish/package.nix b/pkgs/by-name/st/stockfish/package.nix
index 50216db2b95e..02cfd355f012 100644
--- a/pkgs/by-name/st/stockfish/package.nix
+++ b/pkgs/by-name/st/stockfish/package.nix
@@ -3,7 +3,12 @@
   stdenv,
   fetchurl,
   fetchFromGitHub,
-  apple-sdk,
+  versionCheckHook,
+  _experimental-update-script-combinators,
+  nix-update-script,
+  writeShellApplication,
+  nix,
+  gnugrep,
 }:
 
 let
@@ -24,29 +29,31 @@ let
       "unknown";
 
   # These files can be found in src/evaluate.h
-  nnueBigFile = "nn-1111cefa1111.nnue";
+  nnueBigFile = "nn-1c0000000000.nnue";
+  nnueBigHash = "sha256-HAAAAAAApn1imZnZMtDDc/dFDOQ80S0FYoaPTq+a4q0=";
   nnueBig = fetchurl {
     name = nnueBigFile;
     url = "https://tests.stockfishchess.org/api/nn/${nnueBigFile}";
-    sha256 = "sha256-ERHO+hERa3cWG9SxTatMUPJuWSDHVvSGFZK+Pc1t4XQ=";
+    hash = nnueBigHash;
   };
   nnueSmallFile = "nn-37f18f62d772.nnue";
+  nnueSmallHash = "sha256-N/GPYtdy8xB+HWqso4mMEww8hvKrY+ZVX7vKIGNaiZ0=";
   nnueSmall = fetchurl {
     name = nnueSmallFile;
     url = "https://tests.stockfishchess.org/api/nn/${nnueSmallFile}";
-    sha256 = "sha256-N/GPYtdy8xB+HWqso4mMEww8hvKrY+ZVX7vKIGNaiZ0=";
+    hash = nnueSmallHash;
   };
 in
 
 stdenv.mkDerivation rec {
   pname = "stockfish";
-  version = "17";
+  version = "17.1";
 
   src = fetchFromGitHub {
     owner = "official-stockfish";
     repo = "Stockfish";
-    rev = "sf_${version}";
-    sha256 = "sha256-oXvLaC5TEUPlHjhm7tOxpNPY88QxYHFw+Cev3Q8NEeQ=";
+    tag = "sf_${version}";
+    hash = "sha256-c8o1d7/yPnF3Eo7M/MSzYuYQr2qt2tIwyu7WfuKMAzg=";
   };
 
   postUnpack = ''
@@ -64,6 +71,37 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/stockfish";
+  versionCheckProgramArg = "--help";
+
+  passthru = {
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script {
+        extraArgs = [ "--version-regex=^sf_([\\d.]+)$" ];
+      })
+      (lib.getExe (writeShellApplication {
+        name = "${pname}-nnue-updater";
+        runtimeInputs = [
+          nix
+          gnugrep
+        ];
+        runtimeEnv = {
+          PNAME = pname;
+          PKG_FILE = builtins.toString ./package.nix;
+          NNUE_BIG_FILE = nnueBigFile;
+          NNUE_BIG_HASH = nnueBigHash;
+          NNUE_SMALL_FILE = nnueSmallFile;
+          NNUE_SMALL_HASH = nnueSmallHash;
+        };
+        text = builtins.readFile ./update.bash;
+      }))
+    ];
+  };
+
   meta = with lib; {
     homepage = "https://stockfishchess.org/";
     description = "Strong open source chess engine";
diff --git a/pkgs/by-name/st/stockfish/update.bash b/pkgs/by-name/st/stockfish/update.bash
new file mode 100644
index 000000000000..aaf294fd027d
--- /dev/null
+++ b/pkgs/by-name/st/stockfish/update.bash
@@ -0,0 +1,20 @@
+new_src="$(nix-build --attr "pkgs.$PNAME.src" --no-out-link)"
+new_nnue_big_file="$(grep --perl-regexp --only-matching 'EvalFileDefaultNameBig "\Knn-(\w+).nnue' "$new_src/src/evaluate.h")"
+new_nnue_small_file="$(grep --perl-regexp --only-matching 'EvalFileDefaultNameSmall "\Knn-(\w+).nnue' "$new_src/src/evaluate.h")"
+new_nnue_big_hash="$(
+    nix hash convert --hash-algo sha256 "$(
+        nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/$new_nnue_big_file"
+    )"
+)"
+new_nnue_small_hash="$(
+    nix hash convert --hash-algo sha256 "$(
+        nix-prefetch-url --type sha256 "https://tests.stockfishchess.org/api/nn/$new_nnue_small_file"
+    )"
+)"
+
+pkg_body="$(<"$PKG_FILE")"
+pkg_body="${pkg_body//"$NNUE_BIG_FILE"/"$new_nnue_big_file"}"
+pkg_body="${pkg_body//"$NNUE_BIG_HASH"/"$new_nnue_big_hash"}"
+pkg_body="${pkg_body//"$NNUE_SMALL_FILE"/"$new_nnue_small_file"}"
+pkg_body="${pkg_body//"$NNUE_SMALL_HASH"/"$new_nnue_small_hash"}"
+echo "$pkg_body" >"$PKG_FILE"