diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index d2164ff8c261..0057e06040b7 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -7,19 +7,19 @@
 }:
 let
   pname = "open-webui";
-  version = "0.4.7";
+  version = "0.4.8";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-LQFedDcECmS142tGH9+/7ic+wKTeMuysK2fjGmvYPYQ=";
+    hash = "sha256-9N/t8hxODM6Dk/eMKS26/2Sh1lJVkq9pNkPcEtbXqb4=";
   };
 
   frontend = buildNpmPackage {
     inherit pname version src;
 
-    npmDepsHash = "sha256-KeHMt51QvF5qfHKQpEbM0ukGm34xo3TFcXKeZ3CrmHM=";
+    npmDepsHash = "sha256-ThOGBurFjndBZcdpiGugdXpv1YCwCN7s3l2JjSk/hY0=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
@@ -148,8 +148,11 @@ python312.pkgs.buildPythonApplication rec {
 
   makeWrapperArgs = [ "--set FRONTEND_BUILD_DIR ${frontend}/share/open-webui" ];
 
-  passthru.tests = {
-    inherit (nixosTests) open-webui;
+  passthru = {
+    tests = {
+      inherit (nixosTests) open-webui;
+    };
+    updateScript = ./update.sh;
   };
 
   meta = {
diff --git a/pkgs/by-name/op/open-webui/update.sh b/pkgs/by-name/op/open-webui/update.sh
new file mode 100755
index 000000000000..51c7871a04c1
--- /dev/null
+++ b/pkgs/by-name/op/open-webui/update.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p git curl jq common-updater-scripts prefetch-npm-deps
+
+set -eou pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+path="$nixpkgs/pkgs/by-name/op/open-webui/package.nix"
+version="$(curl --silent "https://api.github.com/repos/open-webui/open-webui/releases" | jq '.[0].tag_name' --raw-output)"
+
+update-source-version open-webui "${version:1}" --file="$path"
+
+# Fetch npm deps
+tmpdir=$(mktemp -d)
+curl -O --output-dir $tmpdir "https://raw.githubusercontent.com/open-webui/open-webui/refs/tags/${version}/package-lock.json"
+curl -O --output-dir $tmpdir "https://raw.githubusercontent.com/open-webui/open-webui/refs/tags/${version}/package.json"
+pushd $tmpdir
+npm_hash=$(prefetch-npm-deps package-lock.json)
+sed -i 's#npmDepsHash = "[^"]*"#npmDepsHash = "'"$npm_hash"'"#' "$path"
+popd
+rm -rf $tmpdir
+