diff --git a/pkgs/by-name/_1/_1password-gui/update.sh b/pkgs/by-name/_1/_1password-gui/update.sh
index b4a2fb91f1f2..b1fa7a6a1feb 100755
--- a/pkgs/by-name/_1/_1password-gui/update.sh
+++ b/pkgs/by-name/_1/_1password-gui/update.sh
@@ -1,10 +1,14 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p jq curl
+#!nix-shell -i bash -p jq curl gawk
 #shellcheck shell=bash
 set -euo pipefail
 
-# For Linux version checks we rely on Repology API to check 1Password managed Arch User Repository.
-REPOLOGY_PROJECT_URI="https://repology.org/api/v1/project/1password"
+# For Linux version checks we query upstream's APT repository.
+#
+# Repository only offers amd64 packages for the desktop app.
+# We assume updates are always for both architectures.
+OP_APT_REPO_DIST_BASE="https://downloads.1password.com/linux/debian/amd64/dists"
+OP_APT_REPO_COMPONENT_INDEX="main/binary-amd64/Packages"
 
 # For Darwin version checks we query the same endpoint 1Password 8 for Mac queries.
 # This is the base URI. For stable channel an additional path of "N", for beta channel, "Y" is required.
@@ -17,11 +21,7 @@ CURL=(
   "-H" "user-agent: nixpkgs#_1password-gui update.sh" # repology requires a descriptive user-agent
 )
 
-JQ=(
-  "jq"
-  "--raw-output"
-  "--exit-status" # exit non-zero if no output is produced
-)
+JQ=("jq" "--raw-output")
 
 
 read_local_versions() {
@@ -37,36 +37,56 @@ read_local_versions() {
 
 read_remote_versions() {
   local channel="$1"
-  local darwin_beta_maybe
+  local apt_index="${OP_APT_REPO_DIST_BASE}/${channel}/${OP_APT_REPO_COMPONENT_INDEX}"
+  local apt_awk_prog=$'
+    /^Package: 1password$/ { pkg_is_1password_gui=1 }
+    /^Version/ && pkg_is_1password_gui { print $2; exit }
+  '
+  local chan_os ver
 
   if [[ ${channel} == "stable" ]]; then
-    remote_versions["stable/linux"]=$(
-      "${CURL[@]}" "${REPOLOGY_PROJECT_URI}" \
-        | "${JQ[@]}" '.[] | select(.repo == "aur" and .srcname == "1password" and .status == "newest") | .version'
-    )
+    chan_os="${channel}/linux"
+    ver=$("${CURL[@]}" "${apt_index}" | awk "${apt_awk_prog}")
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
+    fi
 
-    remote_versions["stable/darwin"]=$(
+    chan_os="${channel}/darwin"
+    ver=$(
       "${CURL[@]}" "${APP_UPDATES_URI_BASE}/N" \
         | "${JQ[@]}" 'select(.available == "1") | .version'
     )
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
+    fi
   else
-    remote_versions["beta/linux"]=$(
-      # AUR version string uses underscores instead of dashes for betas.
-      # We fix that with a `sub` in jq query.
-      "${CURL[@]}" "${REPOLOGY_PROJECT_URI}" \
-        | "${JQ[@]}" '.[] | select(.repo == "aur" and .srcname == "1password-beta") | .version | sub("_"; "-")'
+    chan_os="${channel}/linux"
+    ver=$(
+      # Deb package version string uses tilde instead of dashes for betas.
+      "${CURL[@]}" "${apt_index}" | awk "${apt_awk_prog}" | sed 's/~/-/'
     )
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
+    fi
 
     # Handle macOS Beta app-update feed quirk.
     # If there is a newer release in the stable channel, queries for beta
     # channel will return the stable channel version; masking the current beta.
-    darwin_beta_maybe=$(
+    chan_os="${channel}/darwin"
+    ver=$(
       "${CURL[@]}" "${APP_UPDATES_URI_BASE}/Y" \
-        | "${JQ[@]}" 'select(.available == "1") | .version'
+        | "${JQ[@]}" 'select(.available == "1" and (.version | endswith(".BETA"))) | .version'
     )
-    # Only consider versions that end with '.BETA'
-    if [[ ${darwin_beta_maybe} =~ \.BETA$ ]]; then
-      remote_versions["beta/darwin"]=${darwin_beta_maybe}
+    if [[ -n ${ver} ]]; then
+      remote_versions["${chan_os}"]="${ver}"
+    else
+      echo "No remote version for ${chan_os}" >&2
     fi
   fi
 }