diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index f408caddd037..c4b3a46784bd 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -2,25 +2,26 @@
   lib,
   stdenv,
   autoPatchelfHook,
+  cacert,
   fetchurl,
   makeBinaryWrapper,
   bash,
+  nodejs,
   versionCheckHook,
+  nix-update-script,
 }:
 
-let
-  sources = lib.importJSON ./sources.json;
-  srcConfig =
-    sources.${stdenv.hostPlatform.system}
-      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  inherit (sources) version;
+  version = "1.0.26";
 
+  # GitHub provide platform-specific SEA binaries as well as a "universal"
+  # package.  Use the universal package as it gives us a bit more flexibility
+  # about how it's configured.  In particular, the SEA binary has fixed ideas
+  # about how paths should be set up which don't reliably hold when using Nix.
   src = fetchurl {
-    url = "https://github.com/github/copilot-cli/releases/download/v${finalAttrs.version}/${srcConfig.name}.tar.gz";
-    inherit (srcConfig) hash;
+    url = "https://github.com/github/copilot-cli/releases/download/v${finalAttrs.version}/github-copilot-${finalAttrs.version}.tgz";
+    hash = "sha256-zNO0clQRfgw6CX9K8NaJXsoOhhNjBfK7KAr0AoL7Oqo=";
   };
 
   nativeBuildInputs = [
@@ -28,27 +29,38 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.cc.lib ];
-  sourceRoot = ".";
+  sourceRoot = "package";
   dontStrip = true;
+  # keytar.node and computer.node have optional system-library deps not provided
+  # here; ignore missing deps rather than fail the build.
+  autoPatchelfIgnoreMissingDeps = true;
 
   installPhase = ''
     runHook preInstall
-    # Use libexec to preserve filename when calling makeBinaryWrapper
-    install -Dm755 copilot $out/libexec/copilot
+    mkdir -p "$out"/lib/github-copilot-cli
+    cp -r * "$out"/lib/github-copilot-cli
     runHook postInstall
   '';
 
   postInstall = ''
-    # Filename must explictly be "copilot" for internal self-referencing
-    makeWrapper $out/libexec/copilot $out/bin/copilot \
-      --add-flags "--no-auto-update" \
+    makeWrapper ${nodejs}/bin/node "$out"/bin/copilot \
+      --add-flag "$out"/lib/github-copilot-cli/index.js \
+      --add-flag --no-auto-update \
+      --set-default NODE_NO_WARNINGS 1 \
+      --set-default SSL_CERT_DIR ${cacert}/etc/ssl/certs \
       --prefix PATH : "${lib.makeBinPath [ bash ]}"
   '';
 
   nativeInstallCheckInputs = [ versionCheckHook ];
+  # TODO are these errors still present after moving to using the "universal"
+  # package?
   doInstallCheck = !stdenv.hostPlatform.isDarwin; # skip on Darwin - OpenSSL errors in sandbox
 
-  passthru.updateScript = ./update.sh;
+  # Looks like GitHub use tags for both pre-release and actually released
+  # versions, but only the actual versions will be available as a GitHub
+  # release, so use the release endpoint rather than nix-update-script`'s
+  # default of looking for tags.
+  passthru.updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
 
   meta = {
     description = "GitHub Copilot CLI brings the power of Copilot coding agent directly to your terminal";
diff --git a/pkgs/by-name/gi/github-copilot-cli/sources.json b/pkgs/by-name/gi/github-copilot-cli/sources.json
deleted file mode 100644
index 9da8d15a1536..000000000000
--- a/pkgs/by-name/gi/github-copilot-cli/sources.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-  "version": "1.0.44",
-  "x86_64-linux": {
-    "name": "copilot-linux-x64",
-    "hash": "sha256-/wdMa5iYdRGiLukIuGzUmXIXaa+lmxaI79M5gHCS0Dw="
-  },
-  "aarch64-linux": {
-    "name": "copilot-linux-arm64",
-    "hash": "sha256-Lq9Fu4OGNMpBPrOXm4MSiWarArG8XNamH0WYFqfVXps="
-  },
-  "x86_64-darwin": {
-    "name": "copilot-darwin-x64",
-    "hash": "sha256-z5k8EKSzPKpSYNawl47ranPhW4KiBC078vx1smiZ9jI="
-  },
-  "aarch64-darwin": {
-    "name": "copilot-darwin-arm64",
-    "hash": "sha256-1am4zC3h0dbgiuZYzDUgacbucPJtEbPXdjtG5ECYMxo="
-  }
-}
diff --git a/pkgs/by-name/gi/github-copilot-cli/update.sh b/pkgs/by-name/gi/github-copilot-cli/update.sh
deleted file mode 100755
index c7bfd9fa50ed..000000000000
--- a/pkgs/by-name/gi/github-copilot-cli/update.sh
+++ /dev/null
@@ -1,46 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq nix
-
-set -euo pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-SOURCES_FILE="$ROOT/sources.json"
-
-LATEST_TAG=$(curl -s https://api.github.com/repos/github/copilot-cli/releases/latest | jq -r .tag_name)
-
-if [ -z "$LATEST_TAG" ] || [ "$LATEST_TAG" = "null" ]; then
-  echo "Failed to fetch latest release from GitHub API"
-  exit 1
-fi
-
-VERSION="${LATEST_TAG#v}"
-
-echo "Updating to version $VERSION"
-
-# Create a temporary file for the JSON content
-TMP_FILE=$(mktemp)
-
-jq -n --arg v "$VERSION" '{version: $v}' > "$TMP_FILE"
-
-process_platform() {
-  local system="$1"
-  local name="$2"
-  local url="https://github.com/github/copilot-cli/releases/download/v${VERSION}/${name}.tar.gz"
-
-  echo "Processing $system..."
-
-  hash=$(nix-prefetch-url --type sha256 "$url")
-  sri_hash=$(nix hash convert --to sri --hash-algo sha256 "$hash")
-
-  jq --arg sys "$system" --arg n "$name" --arg h "$sri_hash" '. + {($sys): {name: $n, hash: $h}}' \
-    "$TMP_FILE" > "${TMP_FILE}.tmp" && mv "${TMP_FILE}.tmp" "$TMP_FILE"
-}
-
-process_platform "x86_64-linux" "copilot-linux-x64"
-process_platform "aarch64-linux" "copilot-linux-arm64"
-process_platform "x86_64-darwin" "copilot-darwin-x64"
-process_platform "aarch64-darwin" "copilot-darwin-arm64"
-
-mv "$TMP_FILE" "$SOURCES_FILE"
-
-echo "Updated sources.json successfully."