diff --git a/nixos/modules/services/monitoring/prometheus/default.nix b/nixos/modules/services/monitoring/prometheus/default.nix
index 965ef9313b53..35fb022631e0 100644
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@@ -1969,7 +1969,7 @@ in
       after = [ "network.target" ];
       serviceConfig = {
         ExecStart =
-          "${cfg.package}/bin/prometheus"
+          "${lib.getExe cfg.package}"
           + optionalString (length cmdlineArgs != 0) (" \\\n  " + concatStringsSep " \\\n  " cmdlineArgs);
         ExecReload = mkIf cfg.enableReload "+${reload}/bin/reload-prometheus";
         User = "prometheus";
@@ -1980,6 +1980,7 @@ in
         StateDirectory = cfg.stateDir;
         StateDirectoryMode = "0700";
         # Hardening
+        CapabilityBoundingSet = [ "" ];
         DeviceAllow = [ "/dev/null rw" ];
         DevicePolicy = "strict";
         LockPersonality = true;
diff --git a/pkgs/by-name/pr/prometheus/disable-react-app.diff b/pkgs/by-name/pr/prometheus/disable-react-app.diff
new file mode 100644
index 000000000000..f98eca28554a
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus/disable-react-app.diff
@@ -0,0 +1,10 @@
+--- ./build_ui.sh	2025-10-22 23:32:08.739188520 +0100
++++ ./build_ui.sh	2025-10-22 23:32:23.753242986 +0100
+@@ -50,7 +50,6 @@ for i in "$@"; do
+   case ${i} in
+   --all)
+     buildModule
+-    buildReactApp
+     buildMantineUI
+     shift
+     ;;
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index 7b75b0b7bff7..082dfcc2e044 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -1,11 +1,10 @@
 {
   stdenv,
-  buildPackages,
   lib,
   go,
   buildGoModule,
+  buildNpmPackage,
   fetchFromGitHub,
-  fetchurl,
   nixosTests,
   enableAWS ? true,
   enableAzure ? true,
@@ -30,11 +29,65 @@
   enableVultr ? true,
   enableXDS ? true,
   enableZookeeper ? true,
+  versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+let
+  source = import ./source.nix;
+
+  inherit (source) version vendorHash;
+
   pname = "prometheus";
-  version = "3.8.0";
+
+  src = fetchFromGitHub {
+    owner = "prometheus";
+    repo = "prometheus";
+    tag = "v${version}";
+    hash = source.hash;
+  };
+
+  assets = buildNpmPackage {
+    pname = "${pname}-assets";
+    inherit version;
+
+    src = "${src}/web/ui";
+
+    npmDepsHash = source.npmDepsHash;
+
+    patches = [
+      # Disable old React app as it depends on deprecated create-react-apps
+      # script
+      ./disable-react-app.diff
+    ];
+
+    env.CI = true;
+
+    doCheck = true;
+    checkPhase = ''
+      runHook preCheck
+
+      npm test
+
+      runHook postCheck
+    '';
+
+    postInstall = ''
+      mkdir -p $out/static
+      cp -r $out/lib/node_modules/prometheus-io/static/* $out/static
+      find $out/static -type f -exec gzip -f9 {} \;
+
+      # Remove node_modules
+      rm -rf $out/lib
+    '';
+  };
+in
+buildGoModule (finalAttrs: {
+  inherit
+    pname
+    version
+    vendorHash
+    src
+    ;
 
   outputs = [
     "out"
@@ -42,22 +95,6 @@ buildGoModule (finalAttrs: {
     "cli"
   ];
 
-  src = fetchFromGitHub {
-    owner = "prometheus";
-    repo = "prometheus";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-hRuZxwPPDLxQvy5MPKEyfmanNabcSjLRO+XbNKugPtk=";
-  };
-
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  vendorHash = "sha256-5wDaG01vcTtGzrS/S33U5XWXoSWM+N9z3dzXZlILxD8=";
-
-  webUiStatic = fetchurl {
-    url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-oOEvNZFlYtTNBsn+B2pAWXi0A2oJ6IAo7V8bOLtjfCM=";
-  };
-
   excludedPackages = [
     "documentation/prometheus-mixin"
     "internal/tools"
@@ -65,7 +102,7 @@ buildGoModule (finalAttrs: {
   ];
 
   postPatch = ''
-    tar -C web/ui -xzf ${finalAttrs.webUiStatic}
+    cp -r ${assets}/static web/ui/static/
 
     patchShebangs scripts
 
@@ -99,9 +136,18 @@ buildGoModule (finalAttrs: {
   '';
 
   preBuild = ''
-    if [[ -d vendor ]]; then
-      GOARCH= CC="$CC_FOR_BUILD" LD="$LD_FOR_BUILD" make -o assets assets-compress plugins
-    fi
+    if [[ -d vendor ]]; then GOARCH= make -o assets plugins; fi
+
+    # Recreate the `make assets-compress` target here - workaround permissions
+    # errors
+    cp web/ui/embed.go.tmpl web/ui/embed.go
+
+    find web/ui/static -type f -name '*.gz' -print0 | sort -z | xargs -0 echo //go:embed >> web/ui/embed.go
+
+    echo 'var EmbedFS embed.FS' >> web/ui/embed.go
+
+    # EmbedFS requires relative paths
+    substituteInPlace web/ui/embed.go --replace-fail "web/ui/" ""
   '';
 
   tags = [ "builtinassets" ];
@@ -141,15 +187,26 @@ buildGoModule (finalAttrs: {
     "-skip=TestEvaluations/testdata/aggregators.test"
   ];
 
-  passthru.tests = { inherit (nixosTests) prometheus; };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    tests = { inherit (nixosTests) prometheus; };
+    updateScript = ./update.sh;
+  };
 
   meta = {
     description = "Service monitoring system and time series database";
     homepage = "https://prometheus.io";
     license = lib.licenses.asl20;
+    changelog = "https://github.com/prometheus/prometheus/blob/v${version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [
       fpletz
       Frostman
+      jpds
     ];
     mainProgram = "prometheus";
   };
diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix
new file mode 100644
index 000000000000..d112d1e2116c
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus/source.nix
@@ -0,0 +1,6 @@
+{
+  version = "3.8.1";
+  hash = "sha256-mb1aMWpIELyZaqjYX1teYdtAK/+W9jzdPwzgbT7AVj4=";
+  npmDepsHash = "sha256-wmxvlQWQO2gP2apupMJssqAPr1ntWWIazduQU3AuodU=";
+  vendorHash = "sha256-35pVMl1Hu970BQE6jMzT1xaz/3FaIFWUtel0cl/uBdw=";
+}
diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh
new file mode 100755
index 000000000000..c09ec3a4064b
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus/update.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix coreutils curl jq nix-prefetch-git prefetch-npm-deps
+
+set -euo pipefail
+
+OWNER=prometheus
+REPO=prometheus
+
+# Current version.
+LATEST_NIXPKGS_VERSION=$(nix eval --raw .#prometheus.version 2>/dev/null)
+UPDATE_NIX_OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$LATEST_NIXPKGS_VERSION}
+
+TARGET_TAG="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r '.tag_name')"
+TARGET_VERSION="$(echo "$TARGET_TAG" | sed -e 's/^v//')"
+
+if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
+    # prometheus is up-to-date
+    if [[ -n "$UPDATE_NIX_ATTR_PATH" ]]; then
+        echo "[{}]";
+    fi
+
+    exit 0
+fi
+
+extractVendorHash() {
+    original="${1?original hash missing}"
+    result="$(nix-build -A prometheus.goModules 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
+    [ -z "$result" ] && { echo "$original"; } || { echo "$result"; }
+}
+
+TMP=$(mktemp -d)
+trap 'rm -rf "$TMP"' EXIT
+
+NIXPKGS_PROMETHEUS_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
+SOURCE_NIX="$NIXPKGS_PROMETHEUS_PATH/source.nix"
+
+PREFETCH_JSON=$TMP/prefetch.json
+nix-prefetch-git --rev "$TARGET_TAG" --url "https://github.com/$OWNER/$REPO" > "$PREFETCH_JSON"
+PREFETCH_HASH="$(jq '.hash' -r < "$PREFETCH_JSON")"
+PREFETCH_PATH="$(jq '.path' -r < "$PREFETCH_JSON")"
+NPM_DEPS_HASH="$(prefetch-npm-deps "$PREFETCH_PATH/web/ui/package-lock.json")"
+
+FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  npmDepsHash = "$NPM_DEPS_HASH";
+  vendorHash = "$FAKE_HASH";
+}
+EOF
+
+GO_HASH="$(nix-instantiate --eval -A prometheus.vendorHash | tr -d '"')"
+VENDOR_HASH=$(extractVendorHash "$GO_HASH")
+
+cat > "$SOURCE_NIX" <<-EOF
+{
+  version = "$TARGET_VERSION";
+  hash = "$PREFETCH_HASH";
+  npmDepsHash = "$NPM_DEPS_HASH";
+  vendorHash = "$VENDOR_HASH";
+}
+EOF
+
+if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then
+    exit 0
+fi
+
+cat <<-EOF
+[{
+  "attrPath": "$UPDATE_NIX_ATTR_PATH",
+  "oldVersion": "$UPDATE_NIX_OLD_VERSION",
+  "newVersion": "$TARGET_VERSION",
+  "files": ["$SOURCE_NIX"]
+}]
+EOF