diff --git a/pkgs/by-name/up/upsun/package.nix b/pkgs/by-name/up/upsun/package.nix
index b81390ffc9c1..378226a1cbd4 100644
--- a/pkgs/by-name/up/upsun/package.nix
+++ b/pkgs/by-name/up/upsun/package.nix
@@ -3,34 +3,29 @@
   lib,
   fetchurl,
   testers,
+  installShellFiles,
   upsun
 }:
 
+let versions = lib.importJSON ./versions.json;
+    arch = if stdenvNoCC.isx86_64 then "amd64"
+           else if stdenvNoCC.isAarch64 then "arm64"
+           else throw "Unsupported architecture";
+    os = if stdenvNoCC.isLinux then "linux"
+         else if stdenvNoCC.isDarwin then "darwin"
+         else throw "Unsupported os";
+    versionInfo = versions."${os}-${arch}";
+    inherit (versionInfo) hash url;
+
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "upsun";
-  version = "5.0.13";
+  inherit (versions) version;
 
-  src =
-    {
-      x86_64-darwin = fetchurl {
-        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_darwin_all.tar.gz";
-        hash = "sha256-5JKXtAUnqrlufyNE05uZjEDfJv557auYPriTxvUbMJI=";
-      };
-      aarch64-darwin = fetchurl {
-        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_darwin_all.tar.gz";
-        hash = "sha256-5JKXtAUnqrlufyNE05uZjEDfJv557auYPriTxvUbMJI=";
-      };
-      x86_64-linux = fetchurl {
-        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_linux_amd64.tar.gz";
-        hash = "sha256-fjVL/sbO1wmaJ4qZpUMV/4Q4Jzf0p6qx0ElRdY5EUJU=";
-      };
-      aarch64-linux = fetchurl {
-        url = "https://github.com/platformsh/cli/releases/download/${finalAttrs.version}/upsun_${finalAttrs.version}_linux_arm64.tar.gz";
-        hash = "sha256-MNlQkwsg5SuIQJBDy7yVtcda1odpaUZezCgrat6OW2Q=";
-      };
-    }
-    .${stdenvNoCC.system}
-      or (throw "${finalAttrs.pname}-${finalAttrs.version}: ${stdenvNoCC.system} is unsupported.");
+  nativeBuildInputs = [ installShellFiles ];
+
+  # run ./update
+  src = fetchurl { inherit hash url; };
 
   dontConfigure = true;
   dontBuild = true;
@@ -41,10 +36,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     install -Dm755 upsun $out/bin/upsun
 
+    installShellCompletion completion/bash/upsun.bash \
+        completion/zsh/_upsun
+
     runHook postInstall
   '';
 
   passthru = {
+    updateScript = ./update.sh;
     tests.version = testers.testVersion {
       inherit (finalAttrs) version;
       package = upsun;
diff --git a/pkgs/by-name/up/upsun/update.sh b/pkgs/by-name/up/upsun/update.sh
new file mode 100755
index 000000000000..d01cef8a59e9
--- /dev/null
+++ b/pkgs/by-name/up/upsun/update.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq
+#shellcheck shell=bash
+
+set -eu -o pipefail
+
+version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+    https://api.github.com/repos/platformsh/cli/releases/latest | jq -e -r ".tag_name")
+
+linux_arm64_url=https://github.com/platformsh/cli/releases/download/$version/upsun_${version}_linux_arm64.tar.gz
+linux_amd64_url=https://github.com/platformsh/cli/releases/download/$version/upsun_${version}_linux_amd64.tar.gz
+darwin_all_url=https://github.com/platformsh/cli/releases/download/$version/upsun_${version}_darwin_all.tar.gz
+linux_arm64_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_arm64_url"))
+linux_amd64_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$linux_amd64_url"))
+darwin_all_hash=$(nix hash to-sri --type sha256 $(nix-prefetch-url --type sha256 "$darwin_all_url"))
+jq -n \
+    --arg version "$version" \
+    --arg darwin_all_hash "$darwin_all_hash" \
+    --arg darwin_all_url "$darwin_all_url" \
+    --arg linux_amd64_hash "$linux_amd64_hash" \
+    --arg linux_amd64_url "$linux_amd64_url" \
+    --arg linux_arm64_hash "$linux_arm64_hash" \
+    --arg linux_arm64_url "$linux_arm64_url" \
+    '{ "version": $version,
+    "darwin-amd64": { "hash": $darwin_all_hash, "url": $darwin_all_url },
+    "darwin-arm64": { "hash": $darwin_all_hash, "url": $darwin_all_url },
+    "linux-amd64": { "hash": $linux_amd64_hash, "url": $linux_amd64_url },
+    "linux-arm64": { "hash": $linux_arm64_hash, "url": $linux_arm64_url }
+}' > pkgs/by-name/up/upsun/versions.json
diff --git a/pkgs/by-name/up/upsun/versions.json b/pkgs/by-name/up/upsun/versions.json
new file mode 100644
index 000000000000..dbf2a66f0d68
--- /dev/null
+++ b/pkgs/by-name/up/upsun/versions.json
@@ -0,0 +1,19 @@
+{
+  "version": "5.0.21",
+  "darwin-amd64": {
+    "hash": "sha256-ePm8QOJcC87CqB1PbSAoMblopr7JsViHWW3BEQ+gjlQ=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.0.21/upsun_5.0.21_darwin_all.tar.gz"
+  },
+  "darwin-arm64": {
+    "hash": "sha256-ePm8QOJcC87CqB1PbSAoMblopr7JsViHWW3BEQ+gjlQ=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.0.21/upsun_5.0.21_darwin_all.tar.gz"
+  },
+  "linux-amd64": {
+    "hash": "sha256-1qbgXI3VtYoI/4EWPZ1jmWBVJEP+A60PIqXS38wnBPQ=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.0.21/upsun_5.0.21_linux_amd64.tar.gz"
+  },
+  "linux-arm64": {
+    "hash": "sha256-pUdRvVtEokuf7gznUogyufTtloy4MuT5TMcJ4z1bcwo=",
+    "url": "https://github.com/platformsh/cli/releases/download/5.0.21/upsun_5.0.21_linux_arm64.tar.gz"
+  }
+}