diff --git a/pkgs/by-name/ce/cel-go/package.nix b/pkgs/by-name/ce/cel-go/package.nix
index c74d5151f09e..2b0c3085dd31 100644
--- a/pkgs/by-name/ce/cel-go/package.nix
+++ b/pkgs/by-name/ce/cel-go/package.nix
@@ -6,13 +6,13 @@
 let
   cel-spec = buildGoModule (finalAttrs: {
     pname = "cel-spec";
-    version = "0.25.1";
+    version = "0.25.2";
 
     src = fetchFromGitHub {
       owner = "google";
       repo = "cel-spec";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-D9NHnQerquU2nDhDIheHmzV2FUwKi+MfTO+sehMXudg=";
+      hash = "sha256-aNyBGUlpTqILCiQHo7BxaZShI6q9xgtRegywd+jQSlo=";
     };
 
     vendorHash = "sha256-7Ngemih4jRO6VHSH2QxU/p1Q/E/ukUZ5wuUbZzRj6kA=";
@@ -26,18 +26,18 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "cel-go";
-  version = "0.28.0";
+  version = "0.28.1";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "cel-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A+SiKpagf73u+dFclntoPTCNCG+7m4kutS6fpeZ+jDU=";
+    hash = "sha256-fiFkoYVKdSdYkSMQxmC1SvEEGsalBasCl9tzsGSYwmw=";
   };
 
   modRoot = "repl";
 
-  vendorHash = "sha256-obxFjr++fSKJx7TxTZ28YFhts2e/pW32BFVhOGnY7XY=";
+  vendorHash = "sha256-tMaDwKoE5tzbQD5b7EnpKqiT/CT9WDCKgoxQeyhIlXE=";
 
   subPackages = [
     "main"
@@ -62,6 +62,11 @@ buildGoModule (finalAttrs: {
     mv $out/bin/{main,cel-go}
   '';
 
+  passthru = {
+    inherit cel-spec;
+    updateScript = ./update.sh;
+  };
+
   meta = {
     changelog = "https://github.com/google/cel-go/releases/tag/${finalAttrs.src.tag}";
     description = "Fast, portable, non-Turing complete expression evaluation with gradual typing";
diff --git a/pkgs/by-name/ce/cel-go/update.sh b/pkgs/by-name/ce/cel-go/update.sh
new file mode 100755
index 000000000000..b0e22783692c
--- /dev/null
+++ b/pkgs/by-name/ce/cel-go/update.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix bash nix-update
+
+set -eou pipefail
+
+PACKAGE_DIR=$(realpath $(dirname $0))
+
+latestTag=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} -sL https://api.github.com/repos/google/cel-go/releases/latest | jq --raw-output .tag_name)
+latestVersion=$(echo "$latestTag" | sed 's/^v//')
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; cel-go.version or (lib.getVersion cel-go)" | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+nix-update cel-go
+nix-update cel-go.cel-spec