diff --git a/pkgs/by-name/wi/wire-desktop/package.nix b/pkgs/by-name/wi/wire-desktop/package.nix
index 0f89a5bb4881..d7092b4afeca 100644
--- a/pkgs/by-name/wi/wire-desktop/package.nix
+++ b/pkgs/by-name/wi/wire-desktop/package.nix
@@ -26,25 +26,21 @@ let
 
   pname = "wire-desktop";
 
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+
   version =
-    let
-      x86_64-darwin = "3.39.5211";
-    in
     {
-      inherit x86_64-darwin;
-      aarch64-darwin = x86_64-darwin;
-      x86_64-linux = "3.39.3653";
+      x86_64-darwin = versions.macos.version;
+      aarch64-darwin = versions.macos.version;
+      x86_64-linux = versions.linux.version;
     }
     .${system} or throwSystem;
 
   hash =
-    let
-      x86_64-darwin = "sha256-k6CIqHt67AFL70zdK0/91aQcpbb00OIggk5TF7y1IOY=";
-    in
     {
-      inherit x86_64-darwin;
-      aarch64-darwin = x86_64-darwin;
-      x86_64-linux = "sha256-BbY+7fGAWW5CR/z4GeoBl5aOewCRuWzQjpQX4x1rzls=";
+      x86_64-darwin = versions.macos.hash;
+      aarch64-darwin = versions.macos.hash;
+      x86_64-linux = versions.linux.hash;
     }
     .${system} or throwSystem;
 
@@ -75,8 +71,21 @@ let
     hydraPlatforms = [ ];
   };
 
+  passthru.updateScript = {
+    command = [
+      ./update.sh
+      ./.
+    ];
+    supportedFeatures = [ "commit" ];
+  };
+
   linux = stdenv.mkDerivation rec {
-    inherit pname version meta;
+    inherit
+      pname
+      version
+      meta
+      passthru
+      ;
 
     src = fetchurl {
       url = "https://wire-app.wire.com/linux/debian/pool/main/Wire-${version}_amd64.deb";
@@ -151,7 +160,12 @@ let
   };
 
   darwin = stdenv.mkDerivation {
-    inherit pname version meta;
+    inherit
+      pname
+      version
+      meta
+      passthru
+      ;
 
     src = fetchurl {
       url = "https://github.com/wireapp/wire-desktop/releases/download/macos%2F${version}/Wire.pkg";
diff --git a/pkgs/by-name/wi/wire-desktop/update.sh b/pkgs/by-name/wi/wire-desktop/update.sh
new file mode 100755
index 000000000000..65fb554d6aab
--- /dev/null
+++ b/pkgs/by-name/wi/wire-desktop/update.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq
+
+set -e
+
+cd $1
+
+releases=$(curl -L \
+  -H "Accept: application/vnd.github+json" \
+  -H "X-GitHub-Api-Version: 2022-11-28" \
+  "https://api.github.com/repos/wireapp/wire-desktop/releases" \
+)
+
+latest=$(jq --argjson suffix '{ "linux": ".deb", "macos": ".pkg" }' \
+  --slurpfile versions versions.json '
+  def platform_latest(platform):
+    map(select(.tag_name | startswith(platform)))
+    | max_by(.tag_name)
+    | { version: .tag_name | ltrimstr(platform + "/")
+      , url: .assets.[]
+             | .browser_download_url
+             | select(endswith($suffix.[platform]))
+      };
+
+  . as $releases
+  | $versions.[] as $old
+  | $old
+  | with_entries( .key as $key
+                  | { key: $key, value: $releases | platform_latest($key) }
+                  | select(.value.version != $old.[$key].version)
+                )
+' <<< "$releases"
+)
+
+urlHashes=$(
+  printf '{ '
+  function entries () {
+    local sep=''
+    for url in $(jq --raw-output '.[].url' <<< "$latest"); do
+      hash=$(nix-hash --to-sri --type sha256 $(nix-prefetch-url $url))
+      if [ -z "$hash" ]; then
+        printf 'Failed to retrieve hash for %s\n' "$url" 2>&1
+      fi
+      printf '%s"%s": "%s"\n' "$sep" "$url" "$hash"
+      sep=', '
+    done
+  }
+  entries
+  printf '}'
+)
+
+commit=$(jq --arg versionJSON "$(printf '%s/versions.json' "$1")" \
+  --slurpfile versions versions.json '
+  $versions.[] as $old
+  | to_entries
+  | map("\(.key) \($old.[.key].version) -> \(.value.version)")
+  | join(", ")
+  | [ if . == ""
+      then empty
+      else { attrPath: "wire-desktop"
+           , oldVersion: "A"
+           , newVersion: "B"
+           , files: [ $versionJSON ]
+           , commitMessage: "wire-desktop: \(.)"
+           }
+      end
+    ]
+' <<< "$latest"
+)
+
+tempfile=$(mktemp)
+
+updated=$(jq --argjson hashes "$urlHashes" --slurpfile versions versions.json '
+  $versions.[] as $old
+  | $old + map_values(with_entries(if .key == "url"
+                                   then { key: "hash"
+                                        , value: $hashes.[.value]
+                                        }
+                                   else .
+                                   end
+                                  )
+                     )
+' <<< "$latest" > $tempfile
+)
+
+mv $tempfile versions.json
+
+printf '%s' "$commit"
+exit 0
diff --git a/pkgs/by-name/wi/wire-desktop/versions.json b/pkgs/by-name/wi/wire-desktop/versions.json
new file mode 100644
index 000000000000..3ef3c71d0589
--- /dev/null
+++ b/pkgs/by-name/wi/wire-desktop/versions.json
@@ -0,0 +1,10 @@
+{
+  "linux": {
+    "version": "3.40.3718",
+    "hash": "sha256-1jBhF+Rnys8C3DaVbCKHDiylox2WG1qRvwnDbQrp1Mk="
+  },
+  "macos": {
+    "version": "3.40.5285",
+    "hash": "sha256-pcWB3irdPyDj55dWmNyc+oThVGgHtIu//EAk1k/56is="
+  }
+}