diff --git a/pkgs/by-name/cl/cloud-custodian/package.nix b/pkgs/by-name/cl/cloud-custodian/package.nix
index c97c179e5f31..9bbf36fc99fc 100644
--- a/pkgs/by-name/cl/cloud-custodian/package.nix
+++ b/pkgs/by-name/cl/cloud-custodian/package.nix
@@ -2,18 +2,21 @@
   lib,
   python3,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cloud-custodian";
-  version = "0.9.38.0";
+  version = "0.9.51.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "cloud-custodian";
     repo = "cloud-custodian";
     tag = finalAttrs.version;
-    hash = "sha256-jGWPwHiETS4+hk9euLLxs0PBb7mxz2PHCbYYlFfLQUw=";
+    hash = "sha256-vL+/Sof61EkVjudwyFnYnkFi2Hggx9NFrvY8nRTaU+0=";
   };
 
   pythonRelaxDeps = [
@@ -24,7 +27,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "urllib3"
   ];
 
-  build-system = with python3.pkgs; [ poetry-core ];
+  build-system = with python3.pkgs; [ hatchling ];
 
   dependencies = with python3.pkgs; [
     argcomplete
@@ -34,6 +37,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     docutils
     importlib-metadata
     jsonpatch
+    cryptography
     jsonschema
     python-dateutil
     pyyaml
@@ -41,15 +45,21 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     urllib3
   ];
 
-  # Requires tox, many packages, and network access
-  checkPhase = ''
-    $out/bin/custodian --help
+  pythonImportsCheck = [
+    "c7n"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+  preVersionCheck = ''
+    version=${lib.versions.pad 3 finalAttrs.version}
   '';
 
   meta = {
     description = "Rules engine for cloud security, cost optimization, and governance";
     homepage = "https://cloudcustodian.io";
     changelog = "https://github.com/cloud-custodian/cloud-custodian/releases/tag/${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ jlesquembre ];
     license = lib.licenses.asl20;
     mainProgram = "custodian";
   };