diff --git a/pkgs/by-name/so/sops/package.nix b/pkgs/by-name/so/sops/package.nix
index aab8f59de88a..0b34ee99df23 100644
--- a/pkgs/by-name/so/sops/package.nix
+++ b/pkgs/by-name/so/sops/package.nix
@@ -3,21 +3,22 @@
   buildGo122Module,
   fetchFromGitHub,
   installShellFiles,
+  versionCheckHook,
   nix-update-script,
 }:
 
 buildGo122Module rec {
   pname = "sops";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchFromGitHub {
     owner = "getsops";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-U8ZJktOSj0JJ70CbXDS3FpNmk07cKnco5w2rt4BnQBU=";
+    hash = "sha256-w2RMK1Fl/k8QXV68j0Kc6shtx4vQa07RCnpgHLM8c8Q=";
   };
 
-  vendorHash = "sha256-+UxngJgKG+gAjnXXEcdXPXQqRcMfRDn4wPeR1IhltC0=";
+  vendorHash = "sha256-wxmSj3QaFChGE+/2my7Oe2mhprwi404izUxteecyggY=";
 
   postPatch = ''
     substituteInPlace go.mod \
@@ -32,8 +33,6 @@ buildGo122Module rec {
     "-X github.com/getsops/sops/v3/version.Version=${version}"
   ];
 
-  passthru.updateScript = nix-update-script { };
-
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
@@ -41,15 +40,21 @@ buildGo122Module rec {
     installShellCompletion --cmd sops --zsh ${./zsh_autocomplete}
   '';
 
-  meta = with lib; {
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://getsops.io/";
     description = "Simple and flexible tool for managing secrets";
     changelog = "https://github.com/getsops/sops/blob/v${version}/CHANGELOG.rst";
     mainProgram = "sops";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       Scrumplex
       mic92
     ];
-    license = licenses.mpl20;
+    license = lib.licenses.mpl20;
   };
 }