diff --git a/pkgs/applications/networking/cluster/terraform-providers/update-provider b/pkgs/applications/networking/cluster/terraform-providers/update-provider
index 4d380a141b8f..38ce1f0b7fcf 100755
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@@ -8,6 +8,7 @@
 #
 set -euo pipefail
 shopt -s inherit_errexit
+set -x
 
 show_usage() {
   cat <<DOC
@@ -97,6 +98,10 @@ echo_provider() {
   echo "== terraform-providers.${provider}: $* =="
 }
 
+is_stable_version() {
+  [[ $1 =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
+}
+
 pushd "$(dirname "$0")" >/dev/null
 
 if [[ ${provider} =~ ^[^/]+/[^/]+$ ]]; then
@@ -112,10 +117,19 @@ fi
 
 homepage="$(read_attr homepage)"
 
-registry_response=$(curl -s "${homepage//providers/v1/providers}")
-
 old_rev="$(read_attr rev)"
-rev="$(jq -r '.tag' <<<"${registry_response}")"
+registry_response_unstable=$(curl -s "${homepage//providers/v1/providers}")
+
+if is_stable_version "${old_rev}"; then
+  version_stable=$(jq -r '.versions | map(select(test("^[0-9]+\\.[0-9]+\\.[0-9]+$"))) | last' <<<${registry_response_unstable})
+  registry_response_stable=$(curl -s "${homepage//providers/v1/providers}/${version_stable}")
+  rev="$(jq -r '.tag' <<<${registry_response_stable})"
+  registry_response=$registry_response_stable
+else
+  rev="$(jq -r '.tag' <<<${registry_response_unstable})"
+  registry_response=$registry_response_unstable
+fi
+
 if [[ ${force} != 1 ]]; then
   if [[ ${old_rev} == "${rev}" ]]; then
     echo_provider "already at version ${rev}"