diff --git a/pkgs/development/libraries/nss/default.nix b/pkgs/development/libraries/nss/default.nix
index fc17bb8e8c55..f8bd34a164de 100644
--- a/pkgs/development/libraries/nss/default.nix
+++ b/pkgs/development/libraries/nss/default.nix
@@ -187,6 +187,8 @@ stdenv.mkDerivation rec {
       runHook postInstall
     '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = with lib; {
     homepage = "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS";
     description = "A set of libraries for development of security-enabled client and server applications";
diff --git a/pkgs/development/libraries/nss/update.sh b/pkgs/development/libraries/nss/update.sh
new file mode 100755
index 000000000000..600dbdff004c
--- /dev/null
+++ b/pkgs/development/libraries/nss/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep gnused coreutils common-updater-scripts
+
+set -x
+
+base_url="https://ftp.mozilla.org/pub/security/nss/releases/"
+
+version="$(curl -sSL ${base_url}  | grep 'RTM' | grep -v WITH_CKBI | sed 's|.*>\(NSS_[0-9]*_[0-9]*_*[0-9]*_*[0-9]*_RTM\)/.*|\1|g' | sed 's|NSS_||g' | sed 's|_RTM||g' | sed 's|_|.|g' | sort -V | tail -1)"
+hash="$(nix-hash --type sha256 --base32 ${base_url}/NSS_${version/\./_}_RTM/src/nss-${version}.tar.gz)"
+update-source-version nss "${version}" "${hash}"