diff --git a/pkgs/by-name/co/confluent-cli/package.nix b/pkgs/by-name/co/confluent-cli/package.nix
index 87d5c364691d..2cd59b08acc9 100644
--- a/pkgs/by-name/co/confluent-cli/package.nix
+++ b/pkgs/by-name/co/confluent-cli/package.nix
@@ -1,64 +1,70 @@
 {
-  stdenv,
-  autoPatchelfHook,
-  fetchurl,
   lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "confluent-cli";
-  version = "4.16.0";
+  version = "4.25.0";
 
   # To get the latest version:
   # curl -L https://cnfl.io/cli | sh -s -- -l | grep -v latest | sort -V | tail -n1
   src =
-    {
-      x86_64-linux = fetchurl {
-        url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${version}/confluent_${version}_linux_amd64.tar.gz";
-        hash = "sha256-OFmbIqyDnZxymutdObzPvyuHJnfW353e+ChjDLfhQvI=";
+    let
+      selectSystem =
+        attrs:
+        attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+      system = selectSystem {
+        x86_64-linux = "linux_amd64";
+        aarch64-linux = "linux_arm64";
+        x86_64-darwin = "darwin_amd64";
+        aarch64-darwin = "darwin_arm64";
       };
-      aarch64-linux = fetchurl {
-        url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${version}/confluent_${version}_linux_arm64.tar.gz";
-        hash = "sha256-EZ+3WYIkmP5Aw3yg4fKUs805W58OFrILjp+Z18G6jjQ=";
+    in
+    fetchurl {
+      url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${finalAttrs.version}/confluent_${finalAttrs.version}_${system}.tar.gz";
+      hash = selectSystem {
+        x86_64-linux = "sha256-RsbQSHrbbTcQ7o+8Z2E8KFN159bQFtCFRbx8lCFh7nk=";
+        aarch64-linux = "sha256-0liFzNpXvCN/tFJlON00HDOxWaCmtRiRjXDowy+qibc=";
+        x86_64-darwin = "sha256-WdTY04+BHH6iBtIHv2nxgk5O8ETn3WD9tnRmULAhIAQ=";
+        aarch64-darwin = "sha256-y8oDEf5cD7LDhULYzwCKxPx2NBaJS141noSpgS0hsrc=";
       };
-      x86_64-darwin = fetchurl {
-        url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${version}/confluent_${version}_darwin_amd64.tar.gz";
-        hash = "sha256-ogqrGn0I34L+UIzA+9Q+3LlcVoDlYnPRUqkn9oasCG8=";
-      };
-      aarch64-darwin = fetchurl {
-        url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${version}/confluent_${version}_darwin_arm64.tar.gz";
-        hash = "sha256-CQNGs8tFSUH3okFufVPUQqHTrVB3kyrbbgT9mFGmkYc=";
-      };
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    };
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 
   dontStrip = stdenv.hostPlatform.isDarwin;
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/{bin,share/doc/confluent-cli}
     cp confluent $out/bin/
     cp LICENSE $out/share/doc/confluent-cli/
     cp -r legal $out/share/doc/confluent-cli/
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = ./update.sh;
+
+  meta = {
     description = "Confluent CLI";
     homepage = "https://docs.confluent.io/confluent-cli/current/overview.html";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfreeRedistributable;
-    maintainers = with maintainers; [
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = with lib.maintainers; [
       rguevara84
       autophagy
     ];
-
     # TODO: There's support for i686 systems but I do not have any such system
     # to build it locally on, it's also unfree so I cannot rely on ofborg to
     # build it. Get the list of supported system by looking at the list of
     # files in the S3 bucket:
     #
     #   https://s3-us-west-2.amazonaws.com/confluent.cloud?prefix=confluent-cli/archives/1.25.0/&delimiter=/%27
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/by-name/co/confluent-cli/update.sh b/pkgs/by-name/co/confluent-cli/update.sh
new file mode 100755
index 000000000000..2992fffd400a
--- /dev/null
+++ b/pkgs/by-name/co/confluent-cli/update.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix curl coreutils jq common-updater-scripts
+
+set -eou pipefail
+
+latestVersion=$(curl -s "https://s3-us-west-2.amazonaws.com/confluent.cloud?prefix=confluent-cli/archives/&delimiter=/" |
+    sed 's/></>\n</g' |
+    grep '<Prefix>confluent-cli/archives/' |
+    sed -n 's#<Prefix>confluent-cli/archives/\(v\?\)\([^/]*\)/</Prefix>#\2#p' |
+    grep -v '^latest$' |
+    sort --version-sort |
+    tail -n1)
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; confluent-cli.version or (lib.getVersion confluent-cli)" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+
+for i in \
+    "x86_64-linux linux_amd64" \
+    "aarch64-linux linux_arm64" \
+    "x86_64-darwin darwin_amd64" \
+    "aarch64-darwin darwin_arm64"; do
+    set -- $i
+    hash=$(nix hash convert --to sri --hash-algo sha256 $(nix-prefetch-url "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/$latestVersion/confluent_${latestVersion}_$2.tar.gz"))
+    update-source-version confluent-cli $latestVersion $hash --system=$1 --ignore-same-version
+done