diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 13789c630c27..da9ad0ae1bdc 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -23,6 +23,9 @@
   gnome-keyring,
   libsecret,
   curl,
+
+  _experimental-update-script-combinators,
+  nix-update-script,
 }:
 
 let
@@ -177,6 +180,20 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    inherit (finalAttrs) cacheRoot cacheApp;
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script {
+        extraArgs = [
+          "--version-regex"
+          ''^release-(\d\.\d\.\d)$''
+        ];
+      })
+      # TODO: in the future, use `nix-update --custom-dep`.
+      ./update-yarn-caches.sh
+    ];
+  };
+
   meta = {
     description = "GUI for managing Git and GitHub";
     homepage = "https://desktop.github.com";
diff --git a/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh b/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh
new file mode 100755
index 000000000000..21909d82c06e
--- /dev/null
+++ b/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix gnused common-updater-scripts
+
+set -euxo pipefail
+
+cd "$(dirname $0)"
+
+setKV() {
+  sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" package.nix
+}
+
+for cache in cacheApp cacheRoot; do
+  hashKey="${cache}Hash"
+  setKV "$hashKey" sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+
+  pushd ../../../..
+  set +e
+  newHash="$(nix-build --no-out-link -A github-desktop.$cache 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')"
+  set -e
+  popd
+
+  if [ -z "$newHash" ]; then
+    echo Failed to update hash for $cache
+    exit 1
+  fi
+  setKV "$hashKey" "$newHash"
+done