diff --git a/pkgs/by-name/up/upbound/package.nix b/pkgs/by-name/up/upbound/package.nix
index 51046a403ff2..caa377efe0f3 100644
--- a/pkgs/by-name/up/upbound/package.nix
+++ b/pkgs/by-name/up/upbound/package.nix
@@ -9,7 +9,10 @@
 let
   inherit (stdenvNoCC.hostPlatform) system;
   sources =
-    if "${version-channel}" == "main" then import ./sources-main.nix else import ./sources-stable.nix;
+    if "${version-channel}" == "main" then
+      lib.importJSON ./sources-main.json
+    else
+      lib.importJSON ./sources-stable.json;
   arch = sources.archMap.${system};
 
 in
@@ -18,13 +21,13 @@ stdenvNoCC.mkDerivation {
   version = sources.version;
   srcs = [
     (fetchurl {
-      url = sources.fetchurlAttrSet.${system}.docker-credential-up.url;
-      sha256 = sources.fetchurlAttrSet.${system}.docker-credential-up.hash;
+      url = sources.fetchurlAttrSet.docker-credential-up.${system}.url;
+      sha256 = sources.fetchurlAttrSet.docker-credential-up.${system}.hash;
     })
 
     (fetchurl {
-      url = sources.fetchurlAttrSet.${system}.up.url;
-      sha256 = sources.fetchurlAttrSet.${system}.up.hash;
+      url = sources.fetchurlAttrSet.up.${system}.url;
+      sha256 = sources.fetchurlAttrSet.up.${system}.hash;
     })
   ];
 
@@ -63,12 +66,13 @@ stdenvNoCC.mkDerivation {
   doCheck = false;
 
   passthru.updateScript = [
-    ./update.sh
+    ./update
     "${version-channel}"
   ];
 
   meta = {
     description = "CLI for interacting with Upbound Cloud, Upbound Enterprise, and Universal Crossplane (UXP)";
+    changelog = "https://docs.upbound.io/reference/cli/rel-notes/#whats-changed";
     homepage = "https://upbound.io";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/up/upbound/sources-main.json b/pkgs/by-name/up/upbound/sources-main.json
new file mode 100644
index 000000000000..a99993068f14
--- /dev/null
+++ b/pkgs/by-name/up/upbound/sources-main.json
@@ -0,0 +1,53 @@
+{
+  "archMap": {
+    "aarch64-darwin": "darwin_arm64",
+    "aarch64-linux": "linux_arm64",
+    "x86_64-darwin": "darwin_amd64",
+    "x86_64-linux": "linux_amd64"
+  },
+  "fetchurlAttrSet": {
+    "docker-credential-up": {
+      "aarch64-darwin": {
+        "hash": "sha256-3fx/wjBoFxmeo55QbRw9cl4GFCFehGpZeVAw1bvooSk=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/docker-credential-up/darwin_arm64.tar.gz"
+      },
+      "aarch64-linux": {
+        "hash": "sha256-FeF7D8WLpK8S6b7QCLaOI7Dm2EzbDqJVp9tfh13BJuU=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/docker-credential-up/linux_arm64.tar.gz"
+      },
+      "x86_64-darwin": {
+        "hash": "sha256-00y9wGMwu5ZsTzlNkSvdwEse5eV4xzLiwQjgSTnmW5w=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/docker-credential-up/darwin_amd64.tar.gz"
+      },
+      "x86_64-linux": {
+        "hash": "sha256-oObO/T/2yOFDaNVJGQCqna130Tyx/sEOCAQMDYhVlNI=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/docker-credential-up/linux_amd64.tar.gz"
+      }
+    },
+    "up": {
+      "aarch64-darwin": {
+        "hash": "sha256-Bf6O6rsth3D5h5olxqHxULuxxPtNhxP+gN69mJnlQTg=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/up/darwin_arm64.tar.gz"
+      },
+      "aarch64-linux": {
+        "hash": "sha256-svTHCjw2ZrTEscNpizOmg9leQAbzhWcPfst3nMUhUXg=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/up/linux_arm64.tar.gz"
+      },
+      "x86_64-darwin": {
+        "hash": "sha256-1LxqRHQjNlRFTGhEyOR9uW407LkqdpVjB3w57hNT/Zk=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/up/darwin_amd64.tar.gz"
+      },
+      "x86_64-linux": {
+        "hash": "sha256-ZLjhD7uCpBURYozX1IjUTJDzPuKFedIZQhRvMqMMsLY=",
+        "url": "https://cli.upbound.io/main/v0.38.0-0.rc.0.29.g59359e0/bundle/up/linux_amd64.tar.gz"
+      }
+    }
+  },
+  "platformList": [
+    "aarch64-darwin",
+    "aarch64-linux",
+    "x86_64-darwin",
+    "x86_64-linux"
+  ],
+  "version": "0.38.0-0.rc.0.29.g59359e0"
+}
diff --git a/pkgs/by-name/up/upbound/sources-main.nix b/pkgs/by-name/up/upbound/sources-main.nix
deleted file mode 100644
index acf3aee01529..000000000000
--- a/pkgs/by-name/up/upbound/sources-main.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-# Generated by "update.sh main" - do not update manually!
-{
-  version = "0.37.0-0.rc.0.38.g797e121";
-
-  platformList = [
-    "aarch64-linux"
-    "x86_64-linux"
-    "x86_64-darwin"
-    "aarch64-darwin"
-  ];
-
-  archMap = {
-    aarch64-linux = "linux_arm64";
-    x86_64-linux = "linux_amd64";
-    x86_64-darwin = "darwin_amd64";
-    aarch64-darwin = "darwin_arm64";
-  };
-
-  fetchurlAttrSet = {
-
-    aarch64-linux.docker-credential-up = {
-      hash = "sha256-nZXniTuLzmV7tK/Pd4BjUzqYYH2OmQKC4yoCHOhZ3C8=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/docker-credential-up/linux_arm64.tar.gz";
-    };
-    x86_64-linux.docker-credential-up = {
-      hash = "sha256-LILaT+vn2CdKzNWxYOeda+Zid9V11I94+vwDGkGwxuQ=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/docker-credential-up/linux_amd64.tar.gz";
-    };
-    x86_64-darwin.docker-credential-up = {
-      hash = "sha256-7eUWveGIbimxbwOGtA6qrU7F8p8EpOCTHXN4vj74qqA=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/docker-credential-up/darwin_amd64.tar.gz";
-    };
-    aarch64-darwin.docker-credential-up = {
-      hash = "sha256-XTgSZjbHXyt1BXNeaHXqdi4gs8eeD/7rE657oAeQKv4=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/docker-credential-up/darwin_arm64.tar.gz";
-    };
-    aarch64-linux.up = {
-      hash = "sha256-cNk4uaXcdH3EucwGnGXGsPbmKGGO+ig3xfJ+fAcwEbo=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/up/linux_arm64.tar.gz";
-    };
-    x86_64-linux.up = {
-      hash = "sha256-3h+Jtl84UdWvs2cbrDsbtqlCCpvvYjzXZLmzDY/9aXE=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/up/linux_amd64.tar.gz";
-    };
-    x86_64-darwin.up = {
-      hash = "sha256-WzngxshyHnR1H7Rhkbw/wkN1i3TWyV8CcBTwLNVggdU=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/up/darwin_amd64.tar.gz";
-    };
-    aarch64-darwin.up = {
-      hash = "sha256-KLcxE4847DE6e0AznjlNZnS6GNhT1JJaCnYDecTZ6EQ=";
-      url = "https://cli.upbound.io/main/v0.37.0-0.rc.0.38.g797e121/bundle/up/darwin_arm64.tar.gz";
-    };
-  };
-}
diff --git a/pkgs/by-name/up/upbound/sources-stable.json b/pkgs/by-name/up/upbound/sources-stable.json
new file mode 100644
index 000000000000..cbf434da428d
--- /dev/null
+++ b/pkgs/by-name/up/upbound/sources-stable.json
@@ -0,0 +1,53 @@
+{
+  "archMap": {
+    "aarch64-darwin": "darwin_arm64",
+    "aarch64-linux": "linux_arm64",
+    "x86_64-darwin": "darwin_amd64",
+    "x86_64-linux": "linux_amd64"
+  },
+  "fetchurlAttrSet": {
+    "docker-credential-up": {
+      "aarch64-darwin": {
+        "hash": "sha256-WuNC7E1i/Yikwe3uq1Hxf4mpAzgqe9T6tI2DFqJFYq8=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/docker-credential-up/darwin_arm64.tar.gz"
+      },
+      "aarch64-linux": {
+        "hash": "sha256-b5ylPJxIVkI3EDY5IFTHll/4F6KDtQLm7eq8J7eGmtA=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/docker-credential-up/linux_arm64.tar.gz"
+      },
+      "x86_64-darwin": {
+        "hash": "sha256-jJV0SX96Isz7+E0MOQ6aq3KDwFZt4knTVuDU3iSIC+4=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/docker-credential-up/darwin_amd64.tar.gz"
+      },
+      "x86_64-linux": {
+        "hash": "sha256-Ek8xTUKFjYekaee+8rjjOKSQQ1jX3asyvVa/jATWR5c=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/docker-credential-up/linux_amd64.tar.gz"
+      }
+    },
+    "up": {
+      "aarch64-darwin": {
+        "hash": "sha256-jDhAB0b1XMAwGgTeL1uXIIg4YoBgpgI9KBdsbyBXjF4=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/up/darwin_arm64.tar.gz"
+      },
+      "aarch64-linux": {
+        "hash": "sha256-mVS1knNDtQjbxj2FXIyx/m/HVUhUSuN2E7HNmdxgtd4=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/up/linux_arm64.tar.gz"
+      },
+      "x86_64-darwin": {
+        "hash": "sha256-5nr+5tCbqoVel97ROn2OamV0s90O6QS9vrbSXIjhJoo=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/up/darwin_amd64.tar.gz"
+      },
+      "x86_64-linux": {
+        "hash": "sha256-MZgQlxi4MrzXG59Q4g5Bjb240E5pf5l1bHGASqSc+OU=",
+        "url": "https://cli.upbound.io/stable/v0.37.0/bundle/up/linux_amd64.tar.gz"
+      }
+    }
+  },
+  "platformList": [
+    "aarch64-darwin",
+    "aarch64-linux",
+    "x86_64-darwin",
+    "x86_64-linux"
+  ],
+  "version": "0.37.0"
+}
diff --git a/pkgs/by-name/up/upbound/sources-stable.nix b/pkgs/by-name/up/upbound/sources-stable.nix
deleted file mode 100644
index 1dfc1b574cd2..000000000000
--- a/pkgs/by-name/up/upbound/sources-stable.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-# Generated by "update.sh stable" - do not update manually!
-{
-  version = "0.36.1";
-
-  platformList = [
-    "aarch64-linux"
-    "x86_64-linux"
-    "x86_64-darwin"
-    "aarch64-darwin"
-  ];
-
-  archMap = {
-    aarch64-linux = "linux_arm64";
-    x86_64-linux = "linux_amd64";
-    x86_64-darwin = "darwin_amd64";
-    aarch64-darwin = "darwin_arm64";
-  };
-
-  fetchurlAttrSet = {
-
-    aarch64-linux.docker-credential-up = {
-      hash = "sha256-BnEQWK1Y4rCDEk5BgkUIeF0oK6C77AQZh6KWhS+MfqM=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/docker-credential-up/linux_arm64.tar.gz";
-    };
-    x86_64-linux.docker-credential-up = {
-      hash = "sha256-4A0Di92G/vi9NR/pH20E8aaSn/jYhduQbYH6aLL2R3E=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/docker-credential-up/linux_amd64.tar.gz";
-    };
-    x86_64-darwin.docker-credential-up = {
-      hash = "sha256-/i4VsDUk0B+htRv0UCjCLT1ByewO8UNHOMbbxqIfvvE=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/docker-credential-up/darwin_amd64.tar.gz";
-    };
-    aarch64-darwin.docker-credential-up = {
-      hash = "sha256-gaaaOfn8oOxjlYruGePFZ+e65cUgRJSlsr4iweVYdSE=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/docker-credential-up/darwin_arm64.tar.gz";
-    };
-    aarch64-linux.up = {
-      hash = "sha256-mxuDhdO0nZkozMsKiKcDPBscgrY0pSChJP5TUJz729E=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/up/linux_arm64.tar.gz";
-    };
-    x86_64-linux.up = {
-      hash = "sha256-oZ1RpPZAKzChRWKUhUcKPRXhqmf3FBXvpFCICMsWh+w=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/up/linux_amd64.tar.gz";
-    };
-    x86_64-darwin.up = {
-      hash = "sha256-a4QsXlfmmFhRYxC0yZ7yVIHmP8VUgggfOZSenMXGlKA=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/up/darwin_amd64.tar.gz";
-    };
-    aarch64-darwin.up = {
-      hash = "sha256-PPHlADbIiQ/CAF746lulvuHjwwo1V563K9Haf/7IjEI=";
-      url = "https://cli.upbound.io/stable/v0.36.1/bundle/up/darwin_arm64.tar.gz";
-    };
-  };
-}
diff --git a/pkgs/by-name/up/upbound/update b/pkgs/by-name/up/upbound/update
new file mode 100755
index 000000000000..d65588ec3579
--- /dev/null
+++ b/pkgs/by-name/up/upbound/update
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+exec "$SCRIPT_DIR"/update.hs "$(realpath "$0")" "$1"
diff --git a/pkgs/by-name/up/upbound/update.hs b/pkgs/by-name/up/upbound/update.hs
new file mode 100755
index 000000000000..d7406f8717a9
--- /dev/null
+++ b/pkgs/by-name/up/upbound/update.hs
@@ -0,0 +1,96 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i runhaskell --packages 'haskellPackages.ghcWithPackages (ps: [ps.aeson ps.aeson-pretty ps.directory ps.process ps.optparse-applicative])'
+
+{-# LANGUAGE OverloadedStrings #-}
+{-# LANGUAGE RecordWildCards #-}
+
+module Main where
+
+import Options.Applicative
+import System.FilePath (takeDirectory, (</>))
+import System.Process (readProcess)
+import Data.Aeson (object, (.=))
+import Data.Aeson.Encode.Pretty (encodePretty', Config(..), defConfig, Indent(..), keyOrder)
+import qualified Data.ByteString.Lazy.Char8 as BL
+import qualified Data.Map.Strict as Map
+import Control.Monad (forM)
+import qualified Data.Text as T
+
+data Options = Options
+  { scriptPath :: FilePath
+  , channel    :: String
+  }
+
+optionsParser :: Parser Options
+optionsParser = Options
+  <$> argument str
+      ( metavar "SCRIPT_PATH"
+     <> help "The path to the script" )
+  <*> argument channelReader
+      ( metavar "CHANNEL"
+     <> help "The release channel (main or stable)" )
+
+channelReader :: ReadM String
+channelReader = eitherReader $ \arg ->
+  if arg `elem` ["main", "stable"]
+      then Right arg
+      else Left "CHANNEL must be one of: main, stable"
+
+-- Custom configuration for pretty-printing JSON
+prettyConfig :: Config
+prettyConfig = defConfig
+  { confIndent = Spaces 2
+  , confCompare = keyOrder ["archMap", "fetchurlAttrSet", "platformList", "version"]
+  }
+
+main :: IO ()
+main = do
+  let opts = info (optionsParser <**> helper)
+          ( fullDesc
+         <> progDesc "Updates the sources-{main|stable}.json files based on the upstream release channel"
+         <> header "update.hs - Haskell script with argument parsing" )
+
+  -- Parse the command-line arguments
+  Options {..} <- execParser opts
+
+  -- Process the arguments
+  let scriptDir = takeDirectory scriptPath
+  let outputFile = scriptDir </> ("sources-" ++ channel ++ ".json")
+
+  -- Fetch current version
+  let baseUrl = "https://cli.upbound.io/" ++ channel
+  currentVersion <- readProcess "curl" ["-s", baseUrl ++ "/current/version"] ""
+  let version = filter (\x -> x /= 'v' && x /= '\n') currentVersion -- Remove the leading 'v' and the new line char
+
+  -- Architecture mapping
+  let archMapping = Map.fromList
+        [ ("aarch64-darwin", "darwin_arm64")
+        , ("x86_64-darwin", "darwin_amd64")
+        , ("aarch64-linux", "linux_arm64")
+        , ("x86_64-linux", "linux_amd64")
+        ]
+
+  -- Build platformList
+  let platformList = Map.keys archMapping
+
+  -- Build fetchurlAttrSet
+  fetchurlAttrSet <- fmap Map.fromList $ forM ["docker-credential-up", "up"] $ \cmd -> do
+    attrs <- forM (Map.toList archMapping) $ \(key, arch) -> do
+      let url = baseUrl ++ "/v" ++ version ++ "/bundle/" ++ cmd ++ "/" ++ arch ++ ".tar.gz"
+      _hash <- readProcess "nix-prefetch-url" [url] ""
+      let hash = T.unpack $ T.strip $ T.pack _hash
+      _sha256Hash <- readProcess "nix" ["hash", "convert", hash, "--hash-algo", "sha256"] ""
+      let sha256Hash = T.unpack $ T.strip $ T.pack _sha256Hash
+      return (key, object ["hash" .= sha256Hash, "url" .= url])
+    return (cmd, object attrs)
+
+  -- Write output to JSON
+  let output = object
+        [ "version" .= version
+        , "platformList" .= platformList
+        , "archMap" .= archMapping
+        , "fetchurlAttrSet" .= fetchurlAttrSet
+        ]
+  BL.writeFile outputFile $ BL.snoc (encodePretty' prettyConfig output) '\n'
+
+  putStrLn $ "Output written to: " ++ outputFile
diff --git a/pkgs/by-name/up/upbound/update.sh b/pkgs/by-name/up/upbound/update.sh
deleted file mode 100755
index ad0460aaade0..000000000000
--- a/pkgs/by-name/up/upbound/update.sh
+++ /dev/null
@@ -1,83 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl
-
-#set -euo pipefail
-
-SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
-
-# value can be main | stable
-# Ensure at least one argument is passed
-if [[ $# -lt 1 ]]; then
-  echo "Error: No argument provided. Please specify 'main' or 'stable'."
-  exit 1
-fi
-
-# Check if the first argument is 'main' or 'stable'
-if [[ "$1" == "main" || "$1" == "stable" ]]; then
-  echo "Valid input: $1"
-else
-  echo "Error: Invalid input. Please specify 'main' or 'stable'."
-  exit 1
-fi
-channel=$1
-
-baseUrl="https://cli.upbound.io/${channel}"
-currentVersion=$(curl ${baseUrl}/current/version)
-
-version="${currentVersion:1}"
-
-declare -A archMapping
-archMapping["aarch64-darwin"]="darwin_arm64"
-archMapping["x86_64-darwin"]="darwin_amd64"
-archMapping["aarch64-linux"]="linux_arm64"
-archMapping["x86_64-linux"]="linux_amd64"
-
-archMapBlock=
-for key in "${!archMapping[@]}"; do
-    line=$(printf "$key = \"${archMapping[$key]}\"; ")
-    archMapBlock="$archMapBlock$line"
-done
-
-platformListBlock=
-for key in "${!archMapping[@]}"; do
-    platformListBlock="$platformListBlock\"$key\" "
-done
-
-cmds=("docker-credential-up" "up")
-fetchurlAttrSetBlock=
-for cmd in "${cmds[@]}"; do
-    for key in "${!archMapping[@]}"; do
-        arch=${archMapping[$key]}
-        url="${baseUrl}/v${version}/bundle/$cmd/${arch}.tar.gz";
-        hash=$(nix-prefetch-url $url)
-        hash=$(nix hash convert "${hash}" --hash-algo sha256)
-        fetchurlAttrSetBlock="
-        ${fetchurlAttrSetBlock}
-        $key.$cmd = {
-          hash = \"${hash}\";
-          url = ${url};
-        };"
-    done
-done
-
-OUT_FILE="$SCRIPT_DIR/sources-${channel}.nix"
-cat >$OUT_FILE <<EOF
-# Generated by "update.sh ${channel}" - do not update manually!
-{
-  version = "${version}";
-
-  platformList = [
-    ${platformListBlock}
-    ];
-
-  archMap = {
-    ${archMapBlock}
-    };
-
-  fetchurlAttrSet = {
-    ${fetchurlAttrSetBlock}
-    };
-}
-EOF
-
-nixfmt $OUT_FILE