diff --git a/pkgs/by-name/gr/graphene-hardened-malloc/package.nix b/pkgs/by-name/gr/graphene-hardened-malloc/package.nix
index aca52d75dc5b..5759f7ef2094 100644
--- a/pkgs/by-name/gr/graphene-hardened-malloc/package.nix
+++ b/pkgs/by-name/gr/graphene-hardened-malloc/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphene-hardened-malloc";
-  version = "2024040900";
+  version = "2024120400";
 
   src = fetchFromGitHub {
     owner = "GrapheneOS";
     repo = "hardened_malloc";
     rev = finalAttrs.version;
-    hash = "sha256-1j7xzhuhK8ZRAJm9dJ95xiTIla7lh3LBiWc/+x/kjp0=";
+    hash = "sha256-VzP7JimAbFcp1HrSS3GArSRhxHaa1s49kFP22iDHt+8=";
   };
 
   nativeCheckInputs = [ python3 ];
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   passthru = {
+    updateScript = ./update.sh;
     ld-preload-tests = stdenv.mkDerivation {
       name = "${finalAttrs.pname}-ld-preload-tests";
       inherit (finalAttrs) src;
diff --git a/pkgs/by-name/gr/graphene-hardened-malloc/update.sh b/pkgs/by-name/gr/graphene-hardened-malloc/update.sh
new file mode 100755
index 000000000000..67ca22cacb82
--- /dev/null
+++ b/pkgs/by-name/gr/graphene-hardened-malloc/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash cacert curl common-updater-scripts
+# shellcheck shell=bash
+set -eu -o pipefail
+
+host="https://releases.grapheneos.org"
+read -ra metadata <<< "$(curl -s "$host/caiman-stable")"
+version=${metadata[0]}
+
+update-source-version graphene-hardened-malloc "$version"