diff --git a/pkgs/by-name/cw/cwtch-ui/git-hashes.json b/pkgs/by-name/cw/cwtch-ui/git-hashes.json
new file mode 100644
index 000000000000..348d620ef116
--- /dev/null
+++ b/pkgs/by-name/cw/cwtch-ui/git-hashes.json
@@ -0,0 +1,3 @@
+{
+  "flutter_gherkin": "sha256-Y8tR84kkczQPBwh7cGhPFAAqrMZKRfGp/02huPaaQZg="
+}
diff --git a/pkgs/by-name/cw/cwtch-ui/package.nix b/pkgs/by-name/cw/cwtch-ui/package.nix
index b4adced87422..cfd59016c7be 100644
--- a/pkgs/by-name/cw/cwtch-ui/package.nix
+++ b/pkgs/by-name/cw/cwtch-ui/package.nix
@@ -4,26 +4,29 @@
   flutter329,
   lib,
   tor,
+  _experimental-update-script-combinators,
+  nix-update-script,
+  runCommand,
+  yq-go,
+  dart,
 }:
+
 let
-  runtimeBinDependencies = [
-    tor
-  ];
-in
-flutter329.buildFlutterApplication rec {
-  pname = "cwtch-ui";
-  version = "1.16.1";
+  version = "1.16.3";
   # This Gitea instance has archive downloads disabled, so: fetchgit
   src = fetchgit {
     url = "https://git.openprivacy.ca/cwtch.im/cwtch-ui";
-    rev = "v${version}";
-    hash = "sha256-VKR02cRcjEapiIo+bQqeJOenmv0Rmzg6qfkI1LtWF10=";
+    tag = "v${version}";
+    hash = "sha256-w1bIT9EIwpmJ4fkOGKo6iI3HdkcYgrGlW0xeecpUn7g=";
   };
+in
+flutter329.buildFlutterApplication {
+  pname = "cwtch-ui";
+  inherit version src;
 
-  pubspecLock = lib.importJSON ./pubspec.json;
-  gitHashes = {
-    flutter_gherkin = "sha256-Y8tR84kkczQPBwh7cGhPFAAqrMZKRfGp/02huPaaQZg=";
-  };
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  gitHashes = lib.importJSON ./git-hashes.json;
 
   flutterBuildFlags = [
     "--dart-define"
@@ -35,7 +38,7 @@ flutter329.buildFlutterApplication rec {
   # These things are added to LD_LIBRARY_PATH, but not PATH
   runtimeDependencies = [ cwtch ];
 
-  extraWrapProgramArgs = "--prefix PATH : ${lib.makeBinPath runtimeBinDependencies}";
+  extraWrapProgramArgs = "--prefix PATH : ${lib.makeBinPath [ tor ]}";
 
   postInstall = ''
     mkdir -p $out/share/applications
@@ -43,6 +46,37 @@ flutter329.buildFlutterApplication rec {
       --replace-fail PREFIX "$out"
   '';
 
+  passthru = {
+    pubspecSource =
+      runCommand "pubspec.lock.json"
+        {
+          inherit src;
+          nativeBuildInputs = [ yq-go ];
+        }
+        ''
+          yq eval --output-format=json --prettyPrint $src/pubspec.lock > "$out"
+        '';
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { })
+      (
+        (_experimental-update-script-combinators.copyAttrOutputToFile "cwtch-ui.pubspecSource" ./pubspec.lock.json)
+        // {
+          supportedFeatures = [ ];
+        }
+      )
+      {
+        command = [
+          dart.fetchGitHashesScript
+          "--input"
+          ./pubspec.lock.json
+          "--output"
+          ./git-hashes.json
+        ];
+        supportedFeatures = [ ];
+      }
+    ];
+  };
+
   meta = {
     description = "Messaging app built on the cwtch decentralized, privacy-preserving, multi-party messaging protocol";
     homepage = "https://cwtch.im/";
diff --git a/pkgs/by-name/cw/cwtch-ui/pubspec.json b/pkgs/by-name/cw/cwtch-ui/pubspec.lock.json
similarity index 100%
rename from pkgs/by-name/cw/cwtch-ui/pubspec.json
rename to pkgs/by-name/cw/cwtch-ui/pubspec.lock.json