diff --git a/pkgs/by-name/zr/zrok/package.nix b/pkgs/by-name/zr/zrok/package.nix
index db8174f00b46..f39d3fc9f3dc 100644
--- a/pkgs/by-name/zr/zrok/package.nix
+++ b/pkgs/by-name/zr/zrok/package.nix
@@ -2,6 +2,10 @@
   lib,
   stdenv,
   fetchzip,
+  writeShellScript,
+  nix-update,
+  jq,
+  common-updater-scripts,
 }:
 
 let
@@ -20,17 +24,17 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-ytksYeWHLWrNeeTW0aCBw+dc0N7WtLtNpqRZ10Y3WbA=";
-      aarch64-linux = "sha256-HbO+IjAiccbyquWrvXrCFRkYKlbvJ2wlk49ydGDbGbs=";
-      armv7l-linux = "sha256-mvZz4MCe9IGdfjfFbrNhmjAidPB8e7IeOLATclTKdcw=";
-      x86_64-darwin = "sha256-mDEn3rnE7FBDlGqrd3pmOL4mplOf7WpGi4A1W1UqVok=";
-      aarch64-darwin = "sha256-yxL9zJDRWrkmizEZ5Da0Lo1YBJEBOJinsOKpOrMKMlY=";
+      x86_64-linux = "sha256-H/KISDC58ILi6oZlLY2HdgJR9ksEt+VeJem4VIFhqcY=";
+      aarch64-linux = "sha256-kfmMi2HeZG81CocOEK+n+UwfKz245Ya4C6iXT2L85pI=";
+      armv7l-linux = "sha256-AZDoQOJMBB1k9r07URj5g8249Od5P039nf3BadzCbPY=";
+      x86_64-darwin = "sha256-B2LeP1hKxifxpGD7BS0Wgd0h+Cf4teFh8ldyqrFhteU=";
+      aarch64-darwin = "sha256-c5vWvb8ZhGAnmlZB/kqErC6SEXClg6vNbJheAAmqV/E=";
     }
     .${system} or throwSystem;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zrok";
-  version = "2.0.0-rc4";
+  version = "2.0.1";
 
   src = fetchzip {
     url = "https://github.com/openziti/zrok/releases/download/v${finalAttrs.version}/zrok_${finalAttrs.version}_${plat}.tar.gz";
@@ -38,14 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
     inherit hash;
   };
 
-  passthru.updateScript = ./update.sh;
-
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
-    cp zrok $out/bin/
-    chmod +x $out/bin/zrok
+    install -D --mode=0755 zrok2 $out/bin/zrok
     ${lib.optionalString stdenv.hostPlatform.isLinux ''
       patchelf --set-interpreter "$(< "$NIX_CC/nix-support/dynamic-linker")" "$out/bin/zrok"
     ''}
@@ -53,6 +53,19 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = writeShellScript "update-script" ''
+    ${lib.getExe nix-update} $UPDATE_NIX_ATTR_PATH --system x86_64-linux
+    latestVersion=$(nix eval --raw --file . $UPDATE_NIX_ATTR_PATH.version)
+    if [[ "$latestVersion" == "$UPDATE_NIX_OLD_VERSION" ]]; then
+      exit 0
+    fi
+    systems=$(nix eval --json -f . $UPDATE_NIX_ATTR_PATH.meta.platforms | ${lib.getExe jq} --raw-output '.[]')
+    for system in $systems; do
+      hash=$(nix store prefetch-file --unpack --json $(nix eval --raw --file . $UPDATE_NIX_ATTR_PATH.src.url --system "$system") | ${lib.getExe jq} --raw-output .hash)
+      ${lib.getExe' common-updater-scripts "update-source-version"} $UPDATE_NIX_ATTR_PATH $latestVersion $hash --system=$system --ignore-same-version --ignore-same-hash
+    done
+  '';
+
   meta = {
     description = "Geo-scale, next-generation sharing platform built on top of OpenZiti";
     homepage = "https://zrok.io";
diff --git a/pkgs/by-name/zr/zrok/update.sh b/pkgs/by-name/zr/zrok/update.sh
deleted file mode 100755
index afd9c4c5774d..000000000000
--- a/pkgs/by-name/zr/zrok/update.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl gnused gawk nix-prefetch
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find package.nix in $ROOT"
-  exit 1
-fi
-
-fetch_arch() {
-  VER="$1"; ARCH="$2"
-  URL="https://github.com/openziti/zrok/releases/download/v${VER}/zrok_${VER}_${ARCH}.tar.gz"
-  nix-prefetch "{ stdenv, fetchzip }:
-stdenv.mkDerivation rec {
-  pname = \"zrok\"; version = \"${VER}\";
-  src = fetchzip { url = \"$URL\"; stripRoot = false; };
-}
-"
-}
-
-replace_sha() {
-  sed -i "s#$1 = \"sha256-.\{44\}\"#$1 = \"$2\"#" "$NIX_DRV"
-}
-
-ZROK_VER=$(curl -Ls -w "%{url_effective}" -o /dev/null https://github.com/openziti/zrok/releases/latest | awk -F'/' '{print $NF}' | sed 's/v//')
-
-ZROK_LINUX_X64_SHA256=$(fetch_arch "$ZROK_VER" "linux_amd64")
-ZROK_LINUX_AARCH64_SHA256=$(fetch_arch "$ZROK_VER" "linux_arm64")
-ZROK_LINUX_ARMV7L_SHA256=$(fetch_arch "$ZROK_VER" "linux_armv7")
-ZROK_DARWIN_X64_SHA256=$(fetch_arch "$ZROK_VER" "darwin_amd64")
-ZROK_DARWIN_ARM64_SHA256=$(fetch_arch "$ZROK_VER" "darwin_arm64")
-
-sed -i "s/version = \".*\"/version = \"$ZROK_VER\"/" "$NIX_DRV"
-
-replace_sha "x86_64-linux" "$ZROK_LINUX_X64_SHA256"
-replace_sha "aarch64-linux" "$ZROK_LINUX_AARCH64_SHA256"
-replace_sha "armv7l-linux" "$ZROK_LINUX_ARMV7L_SHA256"
-replace_sha "x86_64-darwin" "$ZROK_DARWIN_X64_SHA256"
-replace_sha "aarch64-darwin" "$ZROK_DARWIN_ARM64_SHA256"