diff --git a/pkgs/by-name/pa/paratest/package.nix b/pkgs/by-name/pa/paratest/package.nix
index 29516f632607..a4c37a6a5518 100644
--- a/pkgs/by-name/pa/paratest/package.nix
+++ b/pkgs/by-name/pa/paratest/package.nix
@@ -20,6 +20,8 @@
     composerLock = ./composer.lock;
     vendorHash = "sha256-VdJVbAKkbWKZEJ16ZbJ/lmc6ZzPmztXjZ/LAEmRI93o=";
 
+    passthru.updateScript = ./update.sh;
+
     nativeInstallCheckInputs = [
       versionCheckHook
     ];
diff --git a/pkgs/by-name/pa/paratest/update.sh b/pkgs/by-name/pa/paratest/update.sh
new file mode 100755
index 000000000000..6b1621ca11b2
--- /dev/null
+++ b/pkgs/by-name/pa/paratest/update.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq php.packages.composer nix-update coreutils
+
+set -eou pipefail
+
+PACKAGE_NAME="paratest"
+PACKAGE_VERSION=$(nix eval --raw -f. $PACKAGE_NAME.version)
+PACKAGE_DIR="$(dirname "${BASH_SOURCE[0]}")"
+
+# Get latest version from git
+GIT_VERSION="$(curl --silent ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/paratestphp/paratest/releases/latest" | jq '.tag_name' --raw-output)"
+NEW_VERSION="${GIT_VERSION#v}"
+
+# Fail if package and git version are the same
+if [[ "$PACKAGE_VERSION" == "$NEW_VERSION" ]]; then
+    echo "${PACKAGE_NAME} is up-to-date: ${PACKAGE_VERSION}"
+    exit 0
+fi
+
+# Generate composer.lock file
+TMPDIR=$(mktemp -d)
+trap 'rm -rf -- "${TMPDIR}"' EXIT
+
+git clone --depth 1 --branch "${GIT_VERSION}" https://github.com/paratestphp/paratest.git "${TMPDIR}/paratest"
+composer -d "${TMPDIR}/paratest" install --ignore-platform-req=ext-pcov
+cp "${TMPDIR}/paratest/composer.lock" "${PACKAGE_DIR}/composer.lock"
+
+# update package.nix version, hash and vendorHash
+nix-update $PACKAGE_NAME --version="${NEW_VERSION}"